New employee: the IT onboarding checklist for a secure first day

A new colleague starts on Monday. The laptop is still on its way, the account gets created 'real quick' and because the mailbox is not working yet, someone sends the first documents to a private email address. It looks harmless, but what happens on the first day determines how someone works for years to come. Whoever gets a shared password 'for now' on day one is still using it a year later. That is why we treat onboarding at our clients as a security moment, not an administrative chore. Below is the checklist we use for it, in three phases.

Why the first day matters so much

New employees want to start well. They do what they see and what they are told, especially in the first week. That is an opportunity: if the secure way is the normal way from the start, there is nothing to unlearn later. In practice we see that most bad habits in an SME do not come from unwillingness, but from a first day when nothing was ready and everyone improvised.

• The shared password that was 'just for now' is still sitting in the same chat three years later.
• Whoever works from private email on day one has customer data on an account you do not manage after a month.
• Whoever got admin rights straight away because it was easier still has them when they leave.

A week ahead: everything ready before the first day

Most of the work of a good onboarding happens before the new colleague walks in. Count on about an hour of preparation, spread over the week before.

1. Create the account in the person's own name. No 'info@' and no reusing the predecessor's account. One person, one account, so you always know later who did what.
2. Assign rights according to the role, not 'everything like the colleague'. Write down per role which folders, tools and mailboxes are needed and use that list as the starting point.
3. Prepare the laptop and make sure it is managed: encrypted, with automatic updates, antivirus and the ability to wipe it remotely if it gets lost.
4. Arrange the licences: Microsoft 365 or Google Workspace, the accounting package, the CRM. A licence ordered on day one is a lost day and an invitation to improvise.
5. Give access only to the folders and tools that are needed. You can always add more, and that is far easier than taking it away afterwards.

On day 1: set it up together, do not just forward instructions

On the first day itself it takes about an hour and a half, preferably together with someone who has done it themselves. Forwarding a manual does not work. Sitting at the table together does.

1. Set up multi-factor authentication (MFA) together, on the laptop and in the app on the phone. This is the moment it happens, or it never happens.
2. Install the password manager and create the first logins straight from the vault. That way nobody starts with a password they also use at home.
3. Take twenty minutes for phishing: how to recognise a fake email, what to do when in doubt and who to report it to. Our explanation of recognising phishing and what to do if someone clicked is a good starting point.
4. Go through the one-page IT policy and have it not just signed, but understood.
5. Connect a personal phone to work email only if the device is managed. Otherwise provide a company phone, or no email on the phone.

After the first month: adjust

An onboarding is only finished when you evaluate it. Schedule fifteen minutes after a month, that is enough.

1. Review the rights. Has the new colleague been given 'quick' access to something extra in the meantime? Is it still needed?
2. Ask what does not work. Cumbersome steps get bypassed, and bypasses are security holes.
3. Schedule training. A short awareness session or a module on working securely, ideally for the rest of the team at the same time.

Least privilege, and what you deliberately do not do

The principle behind this checklist is called least privilege: everyone gets exactly the access they need for their work, no more. A hacked account can only be abused for what it is allowed to do. The less that is, the smaller the damage. It is not distrust of your people, but protection: whoever is not an admin cannot accidentally break something either.

• Do not share accounts. Not temporarily, not for the shared mailbox either. Shared mailboxes with individual logins exist for that.
• Do not hand out admin rights because it is easy. An admin who clicks on a phishing email hands the attacker the whole house at once.
• No password on a sticky note, no password in an email or chat.

The mirror image: good onboarding makes offboarding easy

Everything you do properly on day one pays off on the day someone leaves. One account in their own name, rights per role, a managed laptop and logins in a shared vault: then offboarding is a matter of half an hour instead of a search for who still has access to what. So also have a look at our checklist for when an employee leaves.