Layer8 practical checklist
Staff and volunteer access lifecycle
Make joining, changing roles and leaving a repeatable process with approval, ownership and verification.
Make the first discussion useful.
Give each access change a trigger, an approver and a completion check. Include staff, volunteers, temporary helpers and service providers without relying on someone's memory of every account.
Prepare before the discussion
- Role descriptions, application owners and an up-to-date staff or volunteer list.
- A list of accounts, devices, badges, shared mailboxes and provider access.
- The join, change and leave notification process and available verification evidence.
Work through the prompts.
Name the trigger and owner
Define who notifies IT or the system owner about a join, role change or departure, and how an urgent departure is handled.
Define role-based access
Document the access a role needs and who approves exceptions. Use individually attributable accounts where the service supports them.
Check administrative access
Approve privileged access separately and record its business need, MFA and review owner. Keep recovery secrets in the approved protected store.
Prepare the working environment
Confirm device ownership, support boundaries, required sign-in methods and the person's training and reporting contacts.
Complete the joining check
Verify that the person can use the approved services and cannot reach a representative restricted area. Use authorized, non-disruptive checks.
Treat a role change as removal and approval
Remove obsolete access before adding the new role's permissions. Include group membership, delegated access, exports and shared resources.
Close access after departure
Address accounts, active sessions, recovery methods, provider access, devices and physical credentials through the approved offboarding process.
Preserve necessary business records
Assign mailbox and file ownership, retention and lawful preservation decisions before disposing of records. Do not transfer personal data without an approved purpose.
Verify a representative case
Check the completed record against the current application inventory. Record evidence of removal and any service limitations or follow-up work.
Review seasonal and shared roles
Reconcile volunteer rotations, event accounts, shared devices and dormant access. Give temporary access an end date and a named reviewer.
Agree the result and the next action.
Use these outputs to judge whether the preparation is useful:
- A join, change and leave checklist with named approvers and system owners.
- A redacted completion record for a representative role change or departure.
- An exception register with a responsible owner and review date.
Review prompt: Apply at every join, role change and departure; reconcile access on an agreed recurring cadence.
Record the next decision
Use your secure workspace to record the issue, what you know, who is responsible and what happens next. Add a due date and a way to check completion. The PDF includes a printable worksheet.
Use the guide within an agreed scope.
Edition 1.0 · Updated October 4, 2026
Agree timing, employment and record-preservation decisions with the responsible organizational owners. This checklist does not require submitting account credentials or personal rosters to Layer8.
Primary references for further reading
These are original Layer8 preparation prompts. The linked organizations do not endorse this guide.
Bring the question. Agree the work.
Managed IT can help scope this work. Maintain the agreed environment and put repeatable operating procedures in place.