docs: add Employee Onboarding & Offboarding SOP (TAB-SOP-IT-001) - #2
Conversation
Adds an industry-standard Standard Operating Procedure covering the full IT account lifecycle. The document includes a document-control block, a RACI responsibility matrix, the Joiner-Mover-Leaver (JML) onboarding and offboarding procedures, verification/QA steps, a records and retention schedule, and alignment mapping to ISO/IEC 27001:2022, NIST SP 800-53, and CIS Controls v8. Also links the new SOP into the Docsify sidebar for navigation. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CMVrvKwoXqvTXja8S94qB3
There was a problem hiding this comment.
Pull request overview
Adds a new IT SOP document describing the employee account lifecycle (Joiner–Mover–Leaver), including controls and compliance mappings, and exposes it in the Docsify navigation.
Changes:
- Added a new “Employee Onboarding & Offboarding” SOP with document control, RACI, onboarding/offboarding procedures, QA, retention, and compliance references.
- Linked the new SOP from the Docsify
_sidebar.mdfor discoverability.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| employeeOnboardingOffboardingSOP.md | Introduces the new onboarding/offboarding SOP and related process/control documentation. |
| _sidebar.md | Adds a navigation link to the new SOP in the Docsify sidebar. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| | Submit onboarding/offboarding request | **R** | **A** | I | I | I | | ||
| | Approve access level | C | **A** | I | **R** | C | | ||
| | Provision accounts & devices | I | I | **R** | **A** | I | | ||
| | Revoke access on separation | I | **A** | **R** | **A** | C | |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: eab6c6c612
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| ## 1. Purpose | ||
|
|
||
| This Standard Operating Procedure (SOP) defines the standardized, repeatable, and auditable process for provisioning IT access to new employees (**onboarding**) and revoking that access when an employee leaves or changes roles (**offboarding**). It exists to ensure that: |
There was a problem hiding this comment.
When this SOP is used for a role change, it says role changes are covered but the document only defines Joiner and Leaver procedures. Without a mover workflow that re-approves access and removes old-role groups, transferred employees can retain stale privileges while operators believe the account lifecycle process is complete. Add a mover section or remove role changes from this SOP.
Useful? React with 👍 / 👎.
| > **Priority:** For involuntary terminations, revocation is performed **before** the employee is notified, coordinated with HR and Security. Disable first, delete later. | ||
|
|
||
| 1. **Disable, do not delete.** Immediately disable the AD account and revoke active Microsoft 365 / Azure AD sessions and tokens. Reset the password to a random value so the account cannot be reused. | ||
| 2. **Revoke access:** remove the user from all security and distribution groups; revoke application and VPN access; disable MFA methods tied to the departing person. |
There was a problem hiding this comment.
In tenants that assign Microsoft 365/Exchange licenses through security groups, this step removes those groups before the next step converts the mailbox or applies retention/litigation hold. That can remove the mailbox license first and block the data-protection action, requiring emergency re-licensing or risking missed retention. Move the mailbox conversion/hold before blanket group removal, or explicitly preserve licensing groups until retention is confirmed.
Useful? React with 👍 / 👎.
Adds an industry-standard Standard Operating Procedure covering the full IT account lifecycle. The document includes a document-control block, a RACI responsibility matrix, the Joiner-Mover-Leaver (JML) onboarding and offboarding procedures, verification/QA steps, a records and retention schedule, and alignment mapping to ISO/IEC 27001:2022, NIST SP 800-53, and CIS Controls v8. Also links the new SOP into the Docsify sidebar for navigation.
Claude-Session: https://claude.ai/code/session_01CMVrvKwoXqvTXja8S94qB3