{
    "workbook": {
        "name": "Employee IT Offboarding Checklist",
        "description": "Offboarding is where security debt accumulates quietly. This runs access revocation, data preservation and asset recovery in an order that leaves an audit trail."
    },
    "fields": [
        {
            "label": "Step",
            "field_type": "text",
            "role": "template",
            "options": ""
        },
        {
            "label": "Guidance",
            "field_type": "textarea",
            "role": "template",
            "options": ""
        },
        {
            "label": "Owner",
            "field_type": "text",
            "role": "entry",
            "options": ""
        },
        {
            "label": "Date done",
            "field_type": "text",
            "role": "entry",
            "options": ""
        },
        {
            "label": "Notes",
            "field_type": "textarea",
            "role": "entry",
            "options": ""
        }
    ],
    "sections": [
        {
            "name": "Immediate — on the last day",
            "objectives": [
                {
                    "Step": "Disable the account",
                    "Guidance": "Disable rather than delete. Deleting first can destroy access to data you still need.",
                    "Owner": "",
                    "Date done": "",
                    "Notes": "",
                    "__status__": "not_started"
                },
                {
                    "Step": "Revoke active sessions and tokens",
                    "Guidance": "A disabled account can still have live sessions on a phone. Force sign-out everywhere.",
                    "Owner": "",
                    "Date done": "",
                    "Notes": "",
                    "__status__": "not_started"
                },
                {
                    "Step": "Remove MFA devices",
                    "Guidance": "Clear registered authenticators and phone numbers so recovery cannot be used later.",
                    "Owner": "",
                    "Date done": "",
                    "Notes": "",
                    "__status__": "not_started"
                },
                {
                    "Step": "Revoke VPN and remote access",
                    "Guidance": "Include anything with its own credential store separate from the directory.",
                    "Owner": "",
                    "Date done": "",
                    "Notes": "",
                    "__status__": "not_started"
                },
                {
                    "Step": "Remove from privileged groups",
                    "Guidance": "Admin rights first, everything else after.",
                    "Owner": "",
                    "Date done": "",
                    "Notes": "",
                    "__status__": "not_started"
                }
            ]
        },
        {
            "name": "Data and mailbox",
            "objectives": [
                {
                    "Step": "Decide mailbox handling",
                    "Guidance": "Forward, delegate or convert to shared — and record who authorised it.",
                    "Owner": "",
                    "Date done": "",
                    "Notes": "",
                    "__status__": "not_started"
                },
                {
                    "Step": "Preserve files",
                    "Guidance": "Transfer ownership of their documents to the manager before any deletion clock starts.",
                    "Owner": "",
                    "Date done": "",
                    "Notes": "",
                    "__status__": "not_started"
                },
                {
                    "Step": "Reassign shared resources",
                    "Guidance": "Anything they owned — distribution lists, shared drives, licences, scheduled jobs.",
                    "Owner": "",
                    "Date done": "",
                    "Notes": "",
                    "__status__": "not_started"
                }
            ]
        },
        {
            "name": "Assets and closure",
            "objectives": [
                {
                    "Step": "Recover hardware",
                    "Guidance": "Laptop, phone, dock, tokens, keys. Record the return against the asset so custody is closed.",
                    "Owner": "",
                    "Date done": "",
                    "Notes": "",
                    "__status__": "not_started"
                },
                {
                    "Step": "Wipe and re-stock the device",
                    "Guidance": "Wipe, then either return it to stock or retire it depending on age.",
                    "Owner": "",
                    "Date done": "",
                    "Notes": "",
                    "__status__": "not_started"
                },
                {
                    "Step": "Cancel or reassign licences",
                    "Guidance": "Reclaiming licences at offboarding is where most licence overspend hides.",
                    "Owner": "",
                    "Date done": "",
                    "Notes": "",
                    "__status__": "not_started"
                },
                {
                    "Step": "Record the completion",
                    "Guidance": "Note who did each step and when — this is the part an auditor asks for.",
                    "Owner": "",
                    "Date done": "",
                    "Notes": "",
                    "__status__": "not_started"
                }
            ]
        }
    ]
}