IT ONBOARDING CHECKLIST
Free IT onboarding checklist — the new hire's device, accounts and first log-in, on one printable sheet
Before day one, day one and the first week, with a block for every account made — and the offboarding checklist that closes them all on the last day. Free in Word and PDF, for the office manager or the IT company that sets people up.
Word and PDF · Free · No email, no sign-up
The short answer
An IT onboarding checklist is the list that gets a new hire from an offer letter to a working first morning: the laptop ordered or reissued, the email and the company log-in made, the groups and folders the role needs and no more, the licenses, the phone; then on day one the first log-in with a password of at least 12 characters, multi-factor authentication on, the password manager, the staff Wi-Fi and automatic updates; and in the first week a few minutes on phishing and a check that everything opens. The sheet below has all of it, with a block to list every account made.
If you run a small IT company, put your name on the Word file and run one for every client's new starter — the list of accounts at the foot is what you'll need the day that person leaves. If you're the office manager doing IT on the side, it's the same sheet: print it the week before the start date and work down it.
Below: the printable onboarding checklist, the offboarding checklist, who does which step, every block explained, the one rule an IT company with healthcare clients should know, and how the checklist goes on an IT company's website.
FREE CHECKLIST · WORD AND PDF
The IT onboarding checklist, ready to print
The new hire, the role, the start date, the manager, the technician and the asset tag at the top; then three checkbox blocks — before day one, day one, the first week — and an accounts-made block with the app, the username and whether multi-factor authentication is on. Letter size, portrait. Free, no email address, no sign-up.
Checklist · one per new hire
| [Your IT company] | |
| IT Onboarding Checklist | |
| Ready before they arrive, working on day one, checked by the end of week one | |
| New hire: ________________________ Role: ________________ Start: __________ | |
| Manager: ________________ Technician: ________________ Asset tag: ________ | |
| Before day one | |
| ☐ | Laptop or desktop ordered, or a spare wiped and reissued |
| ☐ | Email address, company log-in and app licenses created |
| ☐ | Added to the groups and shared folders the role needs — and no others |
| ☐ | Phone, voicemail, printer and Wi-Fi details set up |
| Day one | |
| ☐ | Device and charger handed over, asset tag written above, showing in the antivirus console |
| ☐ | First log-in done, and a new password of at least 12 characters set |
| ☐ | Multi-factor authentication turned on for email and every app that offers it |
| ☐ | Password manager installed and the first passwords saved in it |
| ☐ | On the staff Wi-Fi, not the guest network; automatic updates on |
| ☐ | Shown where files are saved and how they're backed up |
| First week | |
| ☐ | Ten minutes on phishing: how to spot it, and who to tell |
| ☐ | Knows how to ask for IT help, and who to call the day a laptop or phone is lost |
| ☐ | Every app and folder they need opens; nothing they don't need does |
| Accounts made | |
| App: ________________ Username: ________________ MFA on: yes · no | |
| App: ________________ Username: ________________ MFA on: yes · no | |
| App: ________________ Username: ________________ MFA on: yes · no | |
| Never write a password here. Keep this list with the asset tag — offboarding starts from it. | |
| [Your IT company] · [Your phone] · [Your help email] | |
The Word file is a standard .docx — put your company name, phone and help email in the brackets, add a line for each app your client runs (the accounting package, the practice software, the point of sale), and save a master per client. Print at “Actual size”, not “Fit to page”.
THE OFFBOARDING CHECKLIST
The IT offboarding checklist — the last day, in the order that loses nothing
Who's leaving, the last day, the manager, the technician and the time access ends at the top; then three checkbox blocks — before the last day, on the last day, after — and an equipment-back block with the asset tag, the date and the condition.
Checklist · one per leaver
| [Your IT company] | |
| IT Offboarding Checklist | |
| Every account closed, every device back — in the order that loses no files | |
| Leaving: ________________________ Role: ________________ Last day: ________ | |
| Manager: ________________ Technician: ________________ Access ends: ______ | |
| Before the last day | |
| ☐ | The time access ends set with the manager, and written above |
| ☐ | Every account, app and shared password they use listed — start from their onboarding sheet |
| ☐ | Their files, email, shared documents and calendars moved to someone who stays |
| ☐ | Admin logins they hold — website, domain, social, vendors — moved to someone who stays |
| On the last day | |
| ☐ | Email and company log-in disabled at the time set — disabled, not deleted |
| ☐ | Logged out of every session and device, and removed from the multi-factor app |
| ☐ | Shared passwords they knew changed: Wi-Fi, alarm codes, vendor logins |
| ☐ | Out-of-office reply or forwarding set on their mailbox |
| ☐ | Laptop, phone, chargers, key, fob and badge collected |
| After | |
| ☐ | Device wiped, then reissued or stored |
| ☐ | Mailbox kept — converted to shared, or exported — before its license is removed |
| ☐ | Licenses moved to the next hire or cancelled, so nobody pays for an empty seat |
| ☐ | Removed from group chats, shared drives and the phone system |
| ☐ | Account deleted at the end of the hold period your client chose |
| Equipment back | |
| Item: __________________ Tag: __________ Back on: ________ Condition: ________ | |
| Item: __________________ Tag: __________ Back on: ________ Condition: ________ | |
| Disable first, delete later: a disabled account can't be used to log in, and its kept mailbox stays reachable. | |
| [Your IT company] · [Your phone] · [Your help email] | |
Start it from the leaver's onboarding sheet: the accounts-made block is the list of everything to close. Disable first, delete later — a disabled account can't be used to log in, and while its mailbox and files are kept (licensed, or converted to a shared mailbox) the manager can still reach them.
Build the website
Start your IT company website now
Add your business name and your town to the sentence, and Zarla builds the site, with a page for each service and town you list. You edit it in chat and publish when you're ready.
Already have a website? Bring it across →Zarla keeps your old page addresses where it can and redirects the ones that change, helping you keep the Google standing you've built.
WHO DOES WHAT
Onboarding and offboarding: who does which step
In a small business the manager, the new hire and the IT company each own a few lines. Writing down whose line it is is half the checklist.
| Step | Manager | IT company | New hire or leaver |
|---|---|---|---|
| Start date, role and what they need | Tells IT a week ahead | Asks for it on the request form | — |
| Device | Approves the purchase | Orders, sets up, tags | Collects it, returns it |
| Email, log-in, groups, licenses | Says which folders and apps | Creates them, and closes them | — |
| Password and multi-factor authentication | — | Turns it on, shows how | Sets the password; keeps the phone |
| Phishing and lost-device basics | Makes the time for it | Gives the ten minutes | Knows who to tell |
| Files and email when someone leaves | Says who takes them over | Moves them, then disables the account | — |
| Shared passwords and admin logins | Lists the ones they know | Changes them on the last day | — |
STEP BY STEP
How to run onboarding for your IT clients
For the small IT company: the checklist is the same every time, so the work is quick to quote and easy to bill.
Make it yours
Open the Word file, put your company name, phone and help email in the brackets, and add each client's own apps. One master per client.
Ask for a week's notice
A request form on your website with the name, the role, the start date and what they need. A week ahead is the difference between a ready laptop and a borrowed one.
Work down the list
Before day one, then day one with the new hire beside you for the first log-in and multi-factor authentication. Check off each line as it's done.
Keep the accounts block
The accounts made, with the usernames and no passwords, go in the client's file next to the asset tag. It's the offboarding list, written in advance.
Offboard from the same sheet
On the last day, start from the accounts block: disable, move the files, change the shared passwords, collect the device.
Put the checklist online
A new-starter page with the checklist and the request form shows a client exactly what they get, before they call.
Every block on the two checklists, explained
The top lines make it a record. Who, the role, the start date, the manager who asked, the technician who did the setup and the device's asset tag. The asset tag is the line that answers “which laptop did she have?” a year later.
Before day one is the part a new hire never sees. The device ordered or a spare wiped and reissued, the email and log-in made, the groups and shared folders the role needs and no others, the licenses, the phone, and the Wi-Fi and printer details ready. “No others” matters: giving every new hire every folder is how a small business ends up with nobody knowing who can see the payroll.
Day one is the first log-in, done properly. A new password of at least 12 characters and multi-factor authentication on — the FTC's cybersecurity basics for small business put the strong password at 12 characters and say to require multi-factor authentication for sensitive information. Then the password manager, the staff Wi-Fi rather than the guest network, automatic updates on (the same FTC page says to turn them on), and where files are saved and backed up.
The first week is the check. Ten minutes on phishing and who to tell; how to ask for help; what to do if the laptop or phone is lost; and a test that every app and folder they need opens — and that nothing they don't need does. (The device showing up in the antivirus console is a day-one line, so it's covered from the start.)
The accounts-made block is the one that pays off later. The app, the username and whether multi-factor authentication is on — never the password. Kept in the client's file, it's the list the offboarding checklist starts from.
The offboarding checklist runs in the order that loses nothing. Before the last day: the time access ends, set with the manager; every account listed; files and email moved; shared documents and admin logins handed over. On the day: disable rather than delete, log out of every session, remove the multi-factor app, change the shared passwords, set the auto-reply, collect the equipment. After: wipe the device, keep the mailbox (convert it to shared or export it), move or cancel the licenses, and delete the account once the hold period is over.
Neither sheet is HR paperwork. The offer letter, the tax forms and any IT rules the client asks staff to read belong to HR and the client; these two sheets are the IT steps only, and nothing on them is a form anyone agrees to.
For IT companies with healthcare clients: the offboarding line in the rules
In the US, a client covered by HIPAA has one line in the Security Rule that the offboarding checklist answers directly. Under 45 CFR §164.308(a)(3)(ii)(C), termination procedures are an addressable item: “implement procedures for terminating access to electronic protected health information when the employment of, or other arrangement with, a workforce member ends or as required by determinations made as specified in paragraph (a)(3)(ii)(B) of this section.” The before-the-last-day and on-the-last-day blocks are those procedures for the IT side, and the client's own compliance lead decides what else goes with them. Outside healthcare, the FTC's small-business guidance asks for the same habit in plainer words: restrict sensitive information to the people who need it to do their jobs. Rules differ by industry, by state and by country, so check what applies to each client before you write it into their checklist.
Put the checklist on your website, and quote the work from the same place
The office manager searching for an IT onboarding checklist has a new hire starting next week and nobody to set them up. Most IT company websites say “managed services, cloud, security” and leave it there; the one that gets the call shows what a new starter's first day looks like, with a request form beside it. The checklist on this page is that page, already written.
If you build your IT services website with Zarla, add your company name and your town to the sentence above, and Zarla builds the site, with a page for each service and town you list. Then tell the editor “add a new-starter section with the lines on my IT onboarding checklist” and the list goes on the site, in a section you can edit any time.
The quote and the invoice come from the same dashboard. Zarla sends a quote as one link: your customer picks an option, checks off any extras and accepts it online, and Zarla drafts the invoice for exactly what they chose, with any deposit you asked for. Wix and Squarespace also send quotes customers accept online. The IT services estimate template prices a project on paper, and the IT services invoice template shows what the invoice should carry — the monthly plan by device, project hours by task, hardware and licenses resold, the PO number, net 30 and the W-9 details.
Want to see a finished site first? Browse IT services website templates, see how Zarla builds IT services websites, or look at IT services website designs and what agencies charge for them.
Starting or pricing the IT business?
How to start an IT business covers the first clients and the move from break/fix work to a monthly plan; how to become an IT technician covers the certifications and the pay; IT services pricing has the per-user and per-device rates; the IT services business plan puts the numbers together; and the IT services invoice template bills the work.
IT onboarding checklists: common questions
Yes. The onboarding and offboarding checklists on this page download free as a Word document and a PDF, with no email address and no sign-up. Edit the Word files for each client, or print the PDFs and work down them by hand.
Before day one: the device, the email and company log-in, the groups and shared folders the role needs and no others, the licenses, the phone, the Wi-Fi and printer details. Day one: the device handed over with its asset tag, the first log-in with a new password of at least 12 characters, multi-factor authentication, a password manager, the staff Wi-Fi, automatic updates, where files are saved. The first week: phishing basics, how to get help, what to do if a device is lost, and a check that everything they need opens. That's the sheet on this page, with a block to list every account made.
Hand over the device and write down its asset tag; do the first log-in together and set a new password of at least 12 characters; turn on multi-factor authentication for email and every app that offers it; install the password manager; connect to the staff Wi-Fi rather than the guest network; check automatic updates are on; and show where files are saved and backed up. The FTC's small-business guidance puts a strong password at 12 characters and says to require multi-factor authentication for sensitive information.
Before the last day: set the time access ends with the manager, list every account and shared password the person uses, move their files and email, and hand over the documents and admin logins they own. On the last day: disable the email and log-in, log out every session, remove them from the multi-factor app, change shared passwords, set an auto-reply, collect the equipment. After: wipe the device, keep the mailbox (convert it to shared or export it), move or cancel the licenses, delete the account at the end of the hold period. That's the second sheet on this page.
Disable it first. A disabled account can't be used to log in, and as long as its mailbox and files are kept the manager can pick up what was in flight. Before you remove the license, keep the mailbox — convert it to a shared mailbox or export it — because on some systems an unlicensed mailbox is deleted after a while. Delete the account once the hold period the client chose is over, and move or cancel the license so nobody pays for an empty seat.
Because it's the offboarding list written in advance. The app, the username and whether multi-factor authentication is on — never the password — kept in the client's file next to the asset tag. On the last day you start from that list instead of guessing.
It answers one line of it. In the US, a client covered by HIPAA must address termination procedures for access to electronic protected health information when someone leaves (45 CFR §164.308(a)(3)(ii)(C)), and the offboarding checklist is those steps for the IT side. HIPAA asks for much more than a checklist, and the client's compliance lead decides what applies — rules differ by industry, by state and by country.
No. The offer letter, the tax forms and any rules the client asks staff to read belong to HR and the client. These two sheets are the IT steps only — the device, the accounts and the access.
Yes — that's what the Word file is for. Put your company name, phone and help email in the brackets, add each client's own apps, and save a master per client. Run one for every new starter and keep the accounts block on file.
It should — as a new-starter page. An office manager with a hire starting next week wants to see what happens on day one, and the checklist shows it line by line, with your request form beside it. If you build your site with Zarla, tell the editor to add a new-starter section with those lines — it's a section you can edit any time — and quote and invoice the work from the same place.
Sources
Read November 5, 2026.
- Federal Trade Commission — Cybersecurity for Small Business, September 2025 — a strong password is at least 12 characters; never reuse passwords; require multi-factor authentication to protect sensitive information; set a schedule for updating programs, apps, web browsers and operating systems and turn on automatic updates; back up important files regularly; train employees on a regular schedule; restrict sensitive information to those who need it to do their jobs
- 45 CFR §164.308 — HIPAA Security Rule, administrative safeguards (Cornell LII) — (a)(3)(ii)(C), termination procedures (addressable): implement procedures for terminating access to electronic protected health information when the employment of, or other arrangement with, a workforce member ends
Put the new-starter checklist on the website that wins the next client
Add your company name and your town, and Zarla builds the site from that one line — with a page for each service you list and a contact form for new clients, ready to edit in chat.
Already have a website? Bring it across →Zarla keeps your old page addresses where it can and redirects the ones that change, helping you keep the Google standing you've built.