An offboarding process is something every company faces relatively regularly. The frequency and number of layoffs may depend on your business type and size. Although this process may seem quite obvious, there are some specifics that may lead to unwanted consequences. The offboarding should be performed correctly in order to avoid the loss of critical data or unauthorized access to sensitive data from former employees.
Anyway, layoffs are something absolutely common nowadays. Especially when it comes to the Office 365 offboarding with Spinbackup, it is good to understand the risks of improper offboarding and how not to put your own business at it. So let’s take a look at what is our potential threat and how to handle it right.
Risks
Source: agileit.com
Loss or theft of data
There could be different relationships between former employees and the company. In the worst way, the layoff may lead to intentional data deletion as it happened to Lucchese, a boot manufacturer company. The fired person was the IT system administrator. He deleted the core system files and demoted the account permissions of the remaining IT staff. It led to weeks of backlog, lost orders, and sufficient damage.
Even if there’s no conflict, the former employee can accidentally delete important emails or documents while cleaning the working device. If this person were working on some deal or project and didn’t share a crucial document before deletion, it would be lost for good.
Unauthorized access and compliance violations
If your former employee has access to some sensitive data related to your clients or business partners, he or she can destroy it or use it for his/her own purposes. According to a Ponemon Institute research, more than half of the respondents admitted that they would take information from their previous workplace. Also, 40% of the respondents admitted their intentions to use this information on their new job.
The potential damage can’t be counted. Such breach of confidentiality may significantly help your competitors and harm your own business. But this is only a piece of the problem. In addition to the fact that such actions are in themselves a high-ranking problem, it also leads to major compliance violations from the company’s side.
Following regulatory compliance and frameworks is a vital part of the business and security process. Such violations can cost you too much: for example, General Data Protection Regulation Policy (GDPR) fine is up to €20 million or up to 4% of the annual worldwide turnover; Health Insurance Portability and Accountability Act (HIPAA) violation may cost you from $100 to $50,000 per violation (or per record), with a maximum penalty of $1.5 million per year.
Needless to say that the company’s ruined reputation in case of publicity can be added to these costs.
Source: skylinetechnologies.com
Solutions
There are some practices for the Office 365 offboarding process that may help you secure the company from any kind of accidents.
Remote data wipe and access block
The first thing you can do is remotely wipe the employee’s working device. If your company practices the BYOD (Bring Your Own Device) approach, it is good to have a procedure of the company’s data deletion while leaving personal data intact.
Office 365 has a special Mobile Device Management (MDM) solution that allows full or selective (only organization’s data) device wipe. After that, you can reset the ex-employees password and block access to the mailbox via the same MDM.
Note that users may set file-sharing rules or SMTP forwarding for email accounts before it is blocked. In this case, sensitive data is still at risk of leaking. Make sure you have disabled any of these via the Exchange Control Panel or Powershell.
Source: achievers.com
Reassign or deactivate licenses
You can assign a suspended Office 365 license to a new employee who will be assuming the former employee’s roles. If you have no intentions to hire new personnel, you can simply deactivate the license and delete the user’s account. In this case, the account’s data will be deleted but restorable within 30 days (soft deletion). After 30 days this data will be gone forever (hard deletion).
Need a real OEM License? Get a good deal from Impkeys.
Backup solution
When it comes to retention policies, it is always good to make sure that you are insured against sudden data loss, whether it was an intentional or accidental occasion. Office 365 allows maintaining the former accounts with the most expensive E5 subscription. Unfortunately, buying an E5 subscription can be unreasonably expensive, especially if you are looking for a single backup feature.
In order to be sure that everything important is safe and sound, you can find a third party’s backup solution. A qualified cloud backup solution at Spinbackup allows you to archive ex-employee data and retain it for future use, any kind of investigations, or litigation hold. Apart from that, backup software usually offers such features as data migration between accounts, automated backup settings, control of backend up versions, and others.
The more Office 365 holds important data, the more ways of losing it has. Even more, its functionality covers a wide range of administrative work by giving a lot of people access to something important. So, it is crucial to understand how to secure yourself from the unwanted actions of an ex-employee and not let him walk away with your sensitive documents in hand. You may want to create a list of things to pay attention to during the offboarding process. The good news is that many of these things can be done in advance.
Summing up, the main idea of successful offboarding is to look a few steps ahead of what may go wrong. An improper layoff can turn into a security breach leading to serious consequences. Nevertheless, such issues are completely avoidable to a timely and appropriate response.
