Your IT person just left. Here's the first two weeks.

At a lot of 5 to 50 person companies, IT is one person. Sometimes it’s a real IT hire. Often it’s the ops lead, a technical cofounder, or the person who happened to set up Google Workspace in year one. Either way, they hold the keys, and most of what they know lives in their head.

Then they leave. Maybe on good terms with two weeks’ notice. Maybe not. Either way you now have admin accounts nobody else can log into, renewals nobody is tracking, and, if you’re in the middle of a SOC 2 or a customer security review, evidence that stops getting collected.

Here’s how to get through the first two weeks without breaking anything or leaving a door open.

Days 1 to 2: secure access before anything else

Do this first, even if the departure is friendly. It isn’t about trust. It’s about making sure the company can operate without one person’s login.

• Get into every admin console yourself. Google Workspace or Microsoft 365, your cloud provider (AWS, GCP, Azure), your domain registrar, DNS, your password manager, and your device management tool if you have one. If you can’t log in as an admin, that’s the first problem to fix.
• Make sure at least two people have admin. One of them should be a founder or exec. Not a shared account. Two named people.
• Rotate the shared stuff. Any shared passwords, API keys, or service account credentials they had access to. Start with the ones that touch money, customer data, or production.
• Move MFA off their personal phone. This is the one that bites people. Recovery codes and MFA for admin and registrar accounts often sit on the departing person’s device. Re-enroll them on a company-controlled method before they go.
• Disable, don’t delete. When their last day hits, suspend their accounts and transfer ownership of files and mailboxes. Deleting too fast can wipe data you’ll want later, including audit evidence.

If the departure was sudden or tense, do all of this the same day and check the admin audit logs for anything unusual in the last couple of weeks.

Days 3 to 5: find out what they owned

Now build a simple inventory. A spreadsheet is fine. You’re trying to answer one question: what breaks or expires if nobody touches it for 90 days?

Go through:

• Billing. Pull the last three months of card and invoice statements. Every recurring charge is a system someone set up. This is usually the fastest way to find tools nobody else knew about.
• Domains and certificates. Registrar renewal dates, DNS records, SSL certs. An expired domain or cert is an outage that looks like your fault to customers.
• Cloud accounts. Which projects or accounts exist, who has access, and what’s running. Look for forgotten test servers and open storage buckets while you’re there.
• Backups. Where they go, whether they run, and when someone last tested a restore. If nobody knows, assume they don’t work until proven otherwise.
• Vendor contacts. Your MSP, ISP, phone system, copier lease, insurance broker. Change the contact on file to someone still at the company.
• Recurring tasks. Access reviews, patching, onboarding and offboarding steps, evidence uploads for compliance tools like Vanta or Drata. Ask the departing person to list everything they did on a weekly, monthly, and quarterly rhythm.

If they’re still around, an hour-long walkthrough recorded on a screen share is worth more than any handoff doc they’ll write in their last week.

Week 2: protect anything with a deadline

Some things can wait. These usually can’t.

Audits in progress. If you’re mid SOC 2, ISO, or HIPAA work, the auditor needs to know who the new point of contact is. Check your compliance platform for tests that are failing or evidence that’s due. A Type II audit covers a window of time, and gaps in that window show up in the report. A missed access review in month four is harder to explain than one done late with a note.

Customer security questionnaires. If sales has any open, find out who’s answering them now. Don’t let someone guess. Wrong answers on a questionnaire become promises in a contract.

Renewals and expirations. Anything from your Day 3 to 5 inventory that expires in the next 60 days. Put it on a calendar with a real owner.

Cyber insurance. Many policies ask about MFA, backups, and offboarding. If those slip after the person leaves and something goes wrong, it can affect a claim. Make sure what you told your insurer is still true.

Mistakes that make this worse

• Waiting until after their last day to ask questions. Their memory and goodwill are highest while they’re still there.
• Handing all their access to one new person. You just learned why single points of failure hurt. Don’t recreate it.
• Assuming the MSP has it covered. Many MSPs handle laptops and the help desk but never touched your cloud, compliance tooling, or vendor accounts. Ask them exactly what they own.
• Letting audit evidence lapse “for now.” Compliance work done on a schedule is cheap. Reconstructing three missed months is not.
• Rushing a replacement hire to fill the gap. A hire takes months. You need coverage this week.

Deciding what comes next

Once access is secure and you know what exists, you have a clearer picture of the job. For some companies it’s a full-time role. For a lot of small teams it’s a few hours a week: keep the access reviews and evidence moving, answer the questionnaires, watch the renewals, and be the person who knows how it all fits together.

That’s a reasonable thing to cover with a fractional arrangement while you decide, or for good. The work matters, but it rarely fills 40 hours.

A short checklist

1. Get admin access to every core system. At least two named admins.
2. Rotate shared credentials and move MFA to company-controlled devices.
3. Suspend and transfer their accounts on the last day. Don’t delete yet.
4. Build the inventory from billing, domains, cloud, backups, and vendors.
5. Tell your auditor and insurer who the new contact is.
6. Put every renewal and recurring compliance task on a calendar with an owner.

If your IT person just left and you’re mid audit or holding a stack of security questionnaires, I can help you steady things and keep the evidence moving. [email protected].