Employee offboarding is the formal process of separating a user from an organization's resources. A standard security checklist for this process prioritizes the immediate revocation of both physical and logical access. Deactivating key fobs (B) revokes physical access to buildings and secure areas. Suspending the user's email account (D) is a critical step in revoking logical access to communication systems and other federated services, preventing potential data exfiltration or unauthorized activity. These two actions are fundamental and universally applied during offboarding to secure company assets.

A. Quarantine the hard drive in the user's laptop: This is a forensic procedure for legal holds or investigations, not a standard task for every departing employee.

C. Purge all PII associated with the user: Organizations must retain employee data for legal, tax, and regulatory compliance for a specific period; immediate purging is often not permissible.

E. Turn off the network ports underneath the user's desk: Access is typically managed by user authentication (e.g., 802.1X), not by disabling physical ports, which may be needed by the next user.

F. Add the MAC address of the user's computer to a blocklist: Disabling the user's account is a more effective and standard control than MAC filtering, especially for company-owned devices that will be repurposed.

1. Massachusetts Institute of Technology (MIT) Knowledge Base. (n.d.). Termination Checklist for IT Resources. MIT Information Systems and Technology. Retrieved from https://kb.mit.edu/confluence/display/istcontrib/Termination+Checklist+for+IT+Resources. This document explicitly lists "Disable the user's Kerberos account" (which controls email and other services) and "Collect keys

ID cards

etc." as key offboarding tasks.

2. Cornell University IT. (n.d.). De-provisioning IT Services for Departing Employees. Retrieved from https://it.cornell.edu/deprovisioning/de-provisioning-it-services-departing-employees. The checklist includes "Disable NetID

email

and other accounts" and "Collect university-owned equipment and property (keys

ID card

etc.)."

3. Carnegie Mellon University Information Security Office. (n.d.). Guideline for Account Management. Retrieved from https://www.cmu.edu/iso/governance/guidelines/account-management-guideline.html. Section "Account Termination" states

"Computing accounts and related access privileges must be disabled in a timely manner upon termination of employment..." This supports the principle of disabling accounts like email.