Employee departures are a normal part of running a business. People change jobs, retire, move to different departments, or leave unexpectedly. While HR teams typically focus on disabling accounts and collecting company property, one important part of the process can be overlooked: securely disposing of the information and physical media associated with the employee.
An employee’s departure can create a natural opportunity to review documents, equipment and other materials that are no longer needed. That makes employee offboarding particularly relevant as businesses approach the final quarter of the year, when organizational changes, staffing reviews and technology upgrades often take place.
A secure offboarding process should not stop when an employee hands over their keys or laptop. It should also consider what happens to confidential information after it is no longer needed.
Why Employee Offboarding Is an Information Security Issue
Employees interact with sensitive information throughout their time at an organization. Depending on their role, that could include customer records, financial information, employee files, contracts, business plans, printed reports and other confidential documents.
Some information remains part of the company’s official records and must be retained. Other material may be temporary, duplicated, outdated or no longer necessary once a project or employment relationship ends.
The risk comes when businesses fail to distinguish between the two.
The Federal Trade Commission recommends that businesses keep sensitive personal information only as long as there is a legitimate business need for it and properly dispose of information that is no longer needed.
For that reason, secure employee offboarding should include a review of both what must be retained and what can be securely destroyed.
What Paperwork Should Be Reviewed When an Employee Leaves?
Employee files should never be automatically destroyed simply because someone has left the company.
Personnel records may be subject to specific retention requirements, and organizations should follow the applicable federal, state and industry rules before authorizing destruction. Legal holds, pending disputes, investigations, and other circumstances can also require that records be preserved.
Once a record has legitimately reached the end of its retention period, however, keeping it indefinitely can create unnecessary information security risks.
Businesses may also have other employee-related paperwork that does not belong in a personnel file. Examples can include duplicate reports, outdated forms, internal correspondence, draft documents, printed emails and working copies containing confidential information.
A good offboarding process separates records that must remain in the organization’s records system from temporary or expired materials that are eligible for secure destruction.
What Happens to an Employee’s Old Computer or Hard Drive?
Paper is only part of the equation.
An employee’s departure may also result in laptops, desktop computers, hard drives, USB media, CDs, tapes or other storage devices being returned to the organization. Simply deleting files from a device does not necessarily mean the underlying information has been physically eliminated.
AAA Confidential Security provides media and hard-drive destruction for businesses and residential customers. The company physically destroys hard drives and other media to make stored information unrecoverable. Its services include hard drives, solid-state media, removable media, microfiche, film, tapes, CDs and diskettes.
This can be particularly important when an organization is retiring older equipment rather than redeploying it.
If a device will be reused internally, the organization may have an appropriate data-sanitization process. If the equipment is being permanently disposed of, however, businesses should consider how they will ensure the information stored on it cannot be recovered.
Don’t Forget Printed Information at an Employee’s Workspace
A departing employee’s desk can contain more sensitive information than expected.
A filing cabinet might contain old customer paperwork. A drawer could hold copies of reports or invoices. A printer tray might contain documents that were printed and forgotten. There may also be notebooks, drafts or other working documents that contain confidential business information.
These materials can easily become part of an office cleanup without anyone stopping to ask whether they should go into regular recycling. Instead, organizations can establish a secure process for collecting confidential paper during an employee’s departure.
AAA Confidential Security provides lockable security containers that allow businesses to collect documents while preventing unauthorized access. According to the company, trained security staff exchange the containers and transport the materials to its facility, where documents are shredded within 24 hours.
That gives businesses a controlled destination for documents that have been approved for destruction.
How Secure Shredding Fits Into Employee Offboarding
Secure shredding should be treated as one part of a broader offboarding process rather than an isolated cleanup task.
An organization can first identify the records associated with the employee, determine which information must be retained, and separate eligible materials for destruction. Confidential paper can then be placed in a secure shredding container rather than left in an open trash or recycling bin.
For organizations that generate confidential paperwork regularly, a recurring shredding program can help ensure documents do not accumulate between employee departures.
AAA Confidential Security’s ShredSmart program provides businesses with a locking collection bin, scheduled service and a customizable information destruction policy. Each service event includes a Certificate of Destruction, giving organizations documentation that the destruction process was completed.
For a larger office cleanup, a business can also arrange secure document destruction as part of a broader records-management project.
What About Former Employees’ Access to Confidential Information?
Physical document destruction is not a replacement for digital access controls.
When an employee leaves, organizations should have appropriate procedures for reviewing system access, company accounts, credentials, devices and other digital resources. These steps should be coordinated with the company’s IT and security policies.
The physical side of information security still matters, however. A former employee’s old paperwork, storage media or equipment can contain information that remains valuable long after their account has been deactivated.
Thinking about both sides of the equation, digital access and physical information create a more complete offboarding process.
Build Employee Offboarding Into Your Information Destruction Policy
Employee departures are easier to manage when secure destruction is part of an established policy rather than something handled differently each time.
A company’s information destruction policy can explain how employees should handle confidential documents, where materials awaiting destruction should be placed, who can authorize destruction, and how completed destruction is documented.
AAA Confidential Security’s ShredSmart program includes a customizable information destruction policy designed to help businesses manage secure collection and disposal while providing a basis for employee training.
That kind of consistency becomes increasingly important as an organization grows and more employees handle sensitive information.
Frequently Asked Questions About Employee Offboarding and Shredding
Should a business shred an employee’s personnel file when they leave?
No. An employee’s departure does not automatically mean their personnel file can be destroyed. Businesses should first determine the applicable retention requirements and whether any legal or operational reason requires the records to be preserved.
What should happen to an employee’s old hard drive?
If the device is being permanently retired, businesses should use an appropriate secure destruction or data-sanitization process. Physical hard-drive destruction is designed to make stored information unrecoverable. Confidential Security provides hard-drive and media destruction services for businesses and organizations.
Can confidential paperwork go into recycling?
Businesses should not place sensitive paperwork directly into ordinary recycling. Information that is no longer needed should be destroyed using a method that prevents it from being read or reconstructed.
How can businesses securely collect documents awaiting destruction?
Lockable shredding containers provide a controlled way to collect confidential paperwork until scheduled destruction. Confidential Security offers security containers in several sizes for businesses.
Make Secure Offboarding Part of Your Information Security Strategy
An employee leaving the organization should trigger more than an IT checklist.
It can also be an opportunity to review confidential paperwork, identify outdated materials, properly handle retired storage media and ensure that information that has no legitimate business purpose does not remain accessible.
As Illinois businesses prepare for Q4 staffing changes, technology upgrades and year-end records reviews, strengthening the physical side of employee offboarding can help reduce unnecessary information-security risks.
Need a secure way to destroy confidential paper or retired media? AAA Confidential Security Corporation has served Central Illinois since 1984 and provides NAID AAA-certified paper shredding, hard-drive and media destruction, product destruction, secure shredding containers and ShredSmart programs for businesses and organizations.
Contact Confidential Security Corporation to discuss your organization’s document and media destruction needs and find a secure solution for your next employee offboarding or records cleanup.
