A new employee’s first morning should not depend on borrowing someone else’s password or waiting while a manager guesses which folders they need.

For a small business, a useful IT onboarding checklist starts before the first day. Agree on access, prepare equipment, show the person how to work safely, and check that the setup works. One coordinator can keep the record while managers approve business needs and an IT provider handles technical settings.

Before the start date: assign ownership

Record the worker’s name, role, manager, start date, work location, and whether they are an employee or contractor. Identify who approves accounts and who provisions them. Confirm any access start time and temporary-access expiry.

Keep the checklist restricted because it contains personnel and access information. Store passwords, recovery codes, and other secrets in the approved secure system, not the checklist.

1. Approve the access the role actually needs

List email, shared files, accounting, scheduling, customer systems, specialist applications, and remote access as relevant. Have the manager or system owner approve a role and permission level for each service.

Avoid copying another employee’s permissions without checking them. Someone in the same department may hold extra finance access or administrative rights from an earlier role. Give the new person only the access needed for the work; this is often called least privilege.

Completion check: named approvals exist for the required systems, including an end date for temporary or contractor access. Missing approvals remain pending rather than being assumed.

2. Prepare a supported device

Have the provider prepare the laptop or other approved equipment with supported software, security updates, device encryption where supported, screen locking, and approved protection. Record the asset identifier, assigned worker, and return expectations.

Confirm where business files should be saved and whether those locations are covered by the recovery arrangement. Files stored only on a laptop may fall outside the backup scope. Ask before assuming that local folders are protected.

For remote work or personal devices, settle authorization and the appropriate work-data/privacy boundaries before access. Do not use an unmanaged shared family computer as an improvised replacement.

Completion check: the device is inventoried and its required settings have been verified. Needed software and support arrangements are ready.

3. Create individual accounts and secure delivery

Create named accounts rather than sharing a coworker’s login. Provision access only after approval and verify identity before delivering enrollment information through an approved method.

Set up the approved password manager and an extra sign-in check, or MFA, where supported and required. Plan protected recovery methods. Use separate administrative access only when justified and approved; it should not become the normal account for everyday work.

Follow the small business MFA guide when you need a rollout plan rather than just an instruction to “turn it on.”

Completion check: the new employee can sign in through the approved process, relevant MFA requirements are enforced, and authorized recovery is documented and verified without exposing secrets.

4. Test the work, not just the login

Have the worker complete a representative task in each important service. Can they find the right client folder, use the application, and contact support? Confirm access is limited appropriately without browsing unrelated sensitive records as a test.

Check remote access, printing, or specialist tools only where needed. If something is missing, route the change back through approval; do not fix a delay by handing out blanket administrator rights.

Completion check: expected work is possible, excessive permissions have been addressed, and unresolved issues have an owner and due date.

5. Explain a few everyday rules

Show the employee where to store work, which tools are approved, how to report a suspicious message or accidental disclosure, and who to contact if a device is lost.

Explain independent verification of payment-detail changes through a previously known contact. Demonstrate the reporting channel and tell the worker not to approve unexpected MFA prompts. Make clear that prompt reporting is encouraged even if they made a mistake.

Provide the applicable acceptable-use and data-handling rules. Ask for acknowledgment of the actual versions, but also use a short scenario to check understanding. A signature alone does not demonstrate someone knows what to do.

Completion check: the worker can explain the reporting method and where business files belong. Training and policy acknowledgments are recorded.

6. Review after the first week or two

Use an agreed follow-up date to confirm access is still appropriate, temporary permissions have expired, and support issues are resolved. Adjust the timing to risk and the worker’s needs; it is not a universal legal deadline.

For example, a new project coordinator may initially need one client workspace rather than every client folder. At follow-up, the manager confirms the approved scope and removes a temporary training share that is no longer needed.

Completion check: the manager and provider close outstanding tasks with evidence, not just a blanket “all done.”

A short checklist to reuse

  • Manager approves role, systems, and permissions.
  • Provider prepares and inventories the device.
  • Named accounts and secure enrollment are ready.
  • MFA, password management, and recovery are checked.
  • Worker tests representative tasks and knows how to get help.
  • Reporting, payment verification, and data-handling guidance are delivered.
  • Follow-up date, owners, and unresolved issues are recorded.

A message to send before someone starts

[Name] joins as [role] on [date]. Please prepare the approved device and named accounts for [systems], with permissions approved by [manager]. Confirm secure enrollment, MFA and recovery, approved storage, and support contacts. Tell us what remains pending and what needs a decision before the first day. Do not include passwords in the completion record.

Use the same system inventory when the worker eventually leaves. The employee IT departure guide explains preservation, access removal, and ownership transfer. The cybersecurity starting checklist helps place onboarding within the wider business routine.

NIST’s small-business Cybersecurity Framework resources provide broader guidance on responsibilities, access, and awareness. The workflow here is a practical example, not an official NIST checklist or legal advice.