Denomas Offboarding Standards

Purpose

These standards specify requirements related to the offboarding of Denomas team members from all Denomas related computing resources and data assets so as to protect our customers, team members, contractors, company, and other partners from harm caused by both deliberate and inadvertent misuse. Our intention in publishing these standards is to outline information security standards intended to protect Denomas assets.

Scope

These standards apply to all Denomas team-members, contractors, advisors, and contracted parties interacting with Denomas computing resources and accessing company or customer data.

Roles & Responsibilities:

Offboarding Procedure

Notice of Offboarding

Once the termination process has been approved and completed in Workday either by the departing team members Direct Manager (Voluntary) or by Team Member Relations (Involuntary) either a People Connect (Voluntary) or Team Member Relations (Involuntary) team member will submit an Offboarding Workflow Form. In the instance of a Voluntary Termination this process will follow the resignation process initiated by the team member directly in Workday.

This will populate the tracker through which various offboarding automations are triggered in addition to notifying IT Operations; Payroll and other Stakeholders of the team members temination particulars such as the effective date, information about garden leave if applicable and the time at which access to Denomas systems should be terminated in the #offboarding channel.

In alignment with the needs of both People Connect and IT Operations, offboardings will kick off at 16:00pm in the team members regional timezone (EMEA, JAPAC, and NORAM) and 12:00pm in their regional timezone on Friday at which point de-provisioning will commence.

Note: In instances where team members require de-provisioning initiated at outside of those documented above they should reach out to People Connect via direct message or people-connect@denomas.com to arrange an alternate time.

Should the effective date fall on a day which People Connect is unable to support e.g. a Family and Friends Day or Global Holiday, People Connect will reach out to the People Business Partner to discuss alternate offboarding options.

Offboarding Assignments

Per the People Connect Rotation the offboarding will be assigned directly in the offboarding tracker.

Creating the Offboarding Issue

Offboarding issues are created automatically using the data that is populated by the offboarding form. It is essential that the date and time inserted in the tracker is accurate as this will be the time at which the employment bot will open the offboarding issue

The assigned People Connect member will be automatically added to the list of assignees once the offboarding issue is created.

Many teams work to deprovision access including the IT Operations, this should be regarded as urgent and all tasks expected to be completed in 5 working days with the exception of laptop returns, which can take 2 - 4 weeks.

Note: If the team member is temporarily transitioning to a contractor or consultant role, please proceed with the full offboarding process and create a separate onboarding issue to grant only specific temporary access for what they would need to fulfill their contractual obligations.

Creating the Offboarding Issue Manually

In the event that the offboarding issue is not automatically opened or an urgent issue is needed to be opened, the People Connect member can open the offboarding issue manually, by following the steps below:

1. In Denomas Talk, go to your profile as if you were going to send a Denomas Talk message to yourself. Type the command /pops run offboarding <EMPLOYEE_NUMBER>.
2. You will be pinged in Denomas Talk once the offboarding issue is created, which usually takes 30 seconds or so. The ping will include a link to the offboarding issue and merge request removing from team page.
3. You will need to check the Department, Denomas Email Address and Denomas Handle within the issue are correct.

Offboarding Tools

Google Workspace

IT Ops will follow the below steps to set up an auto-response that notifies the sender that the team member they are trying to reach is no longer with Denomas and who to contact.

1. Navigate to Google admin portal and search for the email account.
2. Unsuspend the account, reset sign in cookies, reset password, do not email the password.
3. Move account into the Former Team Memebers Organizational Unit.
4. Use GAM to set a Out of Office Message on the account
5. Add the appropriate template per team member’s department under the Customize rejection notice

The Out of Office message will stay on the account for 90 days, aftewards ITOPs will follow up and archive the account in the G-Suite vault.

Slack

• Bots

IT Ops check if the team member has created any bots before disabling the account. Go to Slack or on your admin Denomas Talk profile click Menu » Configure Apps » Custom Integrations » Bots and search through the bots’ list for the team member. If a bot exists, please DM the manager to confirm if the bot should be removed.

Team Page

As per the automation in place, a merge request is automatically created to remove the team member from the team page. This will update the following:

• Removing the individual file from the data/team_members/person directory
• Removing the picture used in the previous file
• Adjusting the reports_to in case the offboarded team member had reports
• Removing the pet picture in case the team member had any
• Removing the pet page entry
• Update the CODEOWNERS file: change to the manager or remove if the manager is already a codeowner for that file

The People Connect Team member will need to complete:

• Remove the team members ReadMe
  • If the ReadMe is in a private project, request assistance from the IT Ops team to delete (you can tag them in the team page MR and private Denomas Talk channel)
• Check for hardcoded references
  • The People Connect Specialist handling the offboarding should check to see whether the offboarded team members name is listed on any other public Handbook pages. This can be done by doing a Google search for the team members name and “Denomas” - this should pull up results that reflect any association with the team members name and Denomas (including a ReadMe).

Offboarding Compliance

The People Connect Team ensures all offboarding issues are opened within each week of the offboarding date and once all tasks have been completed by the relevant Team Member(s) and/or Departments, the People Connect Team will close the offboarding issue. On a quarterly basis the People Connect Team will audit all open offboarding issues and ping the relevant Departments within the offboarding issue to call for tasks to be completed.

All offboarding tasks by all Departments need to be completed within 5 days of the offboarding date. For systems that are more critical and time sensitive, these will be completed within the first 24 hours (example 1Password, Slack) by the relevant Departments. Information about application & system deprovisioners can be found on the Tech Stack Applications handbook page.

To ensure a successful completion of the offboarding issue, it is important that all tasks are checked off, whether the system/tool is applicable to the offboarding team member or not. Checking the box indicates one of the following:

• I have revoked team member access to this particular system/tool
• I have checked and this team member was not given access to this particular the system/tool

Exceptions

Exceptions to this policy must be approved by People Connect.

References

• Information Security Parent Policy
• Denomas Offboarding
• Denomas Offboarding FAQ

View page source - Edit this page - please contribute.