How to Securely Manage Handover Materials When Leaving a Job

Employee departures are among the highest-risk moments for organizational security. Years of accumulated account credentials, access privileges, and project knowledge concentrated in one person must be transferred systematically and securely.

Writing passwords on sticky notes, listing accounts in shared spreadsheets, or relying on verbal handoffs can lead to serious security incidents. This guide covers how to manage handover materials securely and provides checklists for both departing employees and their managers.

Why Employee Transitions Are High-Risk

Concentrated Access Privileges

Long-tenured employees often hold access to dozens of systems and services. When these privileges are not properly transferred, work stalls. When they are not properly revoked, security breaches follow.

Informal Information Management

Many employees manage work information through personal notes, browser-saved passwords, or authenticator apps on personal devices. This information is difficult to transfer systematically during an offboarding process.

Emotional Factors

Frustration or conflict during the departure process can occasionally lead to intentional data leaks or deletions.

What Needs to Be Handed Over Securely

Item	Examples	Risk Level
Account passwords	Admin accounts, CMS, hosting	Very high
API keys and tokens	Payment services, third-party APIs, cloud	Very high
Server access details	SSH keys, database credentials, VPN accounts	Very high
Project files	Design docs, specifications, source code	High
Client contacts	CRM data, key vendor contacts	High
Work processes	Manuals, recurring procedures, contact lists	Medium

Dangerous Handover Methods

Sticky Notes and Paper

Physical notes are easily lost, photographed, or copied, and there is no way to track who has seen the information.

Shared Spreadsheets

Listing passwords in a Google Sheet or Excel file means anyone with access can view them, and once the file is copied, control is lost entirely.

Verbal Communication

Relying on memory leads to missed items, and without a written record, disputes about what was communicated cannot be resolved.

Regular Messaging Apps

Sending passwords through Slack or WhatsApp leaves them permanently in chat history, accessible even after the employee has left.

A Secure Handover Process

Step 1: Create an Asset Inventory

Document every account and access privilege held by the departing employee.

• All active service accounts
• API keys and tokens in use
• Server and database access credentials
• Project document locations
• Client and vendor contact information

Step 2: Transfer via Password-Protected Memos

Create individual password-protected memos for each set of credentials and share them with the successor. The key is setting an expiration time.

Configuration guide:

• If the handover period is one week, set the memo expiration to 10 days
• Send the link via email and the password via phone call or text message
• Have the successor change the password immediately after viewing

Step 3: Change All Passwords

After the successor confirms receipt, immediately change the passwords for all transferred accounts. This renders the memo content invalid even before the expiration time.

Step 4: Revoke Previous Access

Systematically revoke all access for the departing employee.

• Deactivate company email account
• Remove access from all shared services
• Revoke VPN and remote access credentials
• Collect physical access cards
• Confirm deletion of company data from personal devices

Implementing Secure Handovers with LOCK.PUB

LOCK.PUB's password-protected memos are an ideal tool for employee transitions.

How to Use It

1. Create separate secret memos for each set of account credentials
2. Set expiration times matching the handover period (e.g., 7-14 days)
3. Send memo links to the successor via email
4. Deliver passwords through a separate channel (phone, text)
5. Change the original account passwords after the successor confirms receipt

Advantages of This Approach

• Memos become automatically inaccessible after expiration
• Once passwords are changed, memo content is no longer valid
• Passwords do not remain permanently in chat history
• Analytics let you track whether the successor has viewed the information

Checklist for Departing Employees

• Have you listed all work accounts you manage
• Have you transferred each set of credentials through a secure method
• Have you deleted company data from personal devices
• Have you checked that no work files remain in personal cloud storage
• Have you confirmed there is no information that will be inaccessible after your departure

Checklist for Managers

• Have you identified all access privileges held by the departing employee
• Have you clearly defined the handover period and method
• Have you changed the passwords for all transferred accounts
• Have you revoked all access for the departing employee
• Have you set up monitoring for abnormal access after departure
• Have you documented the handover completion

Get Started Now

A systematic handover protects both organizational security and business continuity. Password-protected memos let you share information securely during the transition period, with automatic access revocation afterward.

Create your first handover memo on LOCK.PUB today.

Create a Secret Memo