A good IT onboarding checklist covers five things: what to prepare before the start date, how to grant access on a least-privilege basis, what security briefing the new hire gets, what IT tests on day one, and what you record. Do these in that order and a new employee can log in, work and handle client data safely on the first morning. This version is written for South African financial services and engineering firms, where client data, project files and POPIA obligations raise the stakes.

Techtron

Make IT onboarding more secure

Techtron supports business IT management, cybersecurity and cloud solutions for firms that need reliable access and protection for new employees.

Explore IT support

TL;DR

Start the IT work when the offer is signed, not on the Monday the person arrives. Devices, accounts and licences need lead time.
Build access from role-based groups, add multifactor authentication (MFA) before the first login, and give one named person accountability for privileged access.
Give every new starter a short security and acceptable-use briefing in week one: phishing, incident reporting and client data handling.
Treat employee and client information as POPIA-regulated from day one, including the contracts with any outside provider that handles it.
Test everything with the employee on day one and keep a signed record. The same record makes offboarding much easier.

Why IT onboarding deserves its own checklist

HR onboarding covers culture, contracts and introductions. IT onboarding decides whether the person can actually work, and whether your firm stays safe while they do. Most of the generic checklists that rank for this topic are HR templates with an “IT” line or two. They miss the issues a finance or engineering firm faces.

Consider what a new hire touches. A junior analyst at a financial services firm may see client portfolios, ID documents and bank details. A new draughtsperson or project engineer opens CAD files, large drawing sets and project data shared with clients and contractors. In both cases a rushed setup leads to shared passwords, over-broad folder access and unmanaged personal devices.

The checklist below is split by timing, so each step has an owner and a deadline.

Before day one: what to prepare

This is the stage most firms underestimate. Aim to start it as soon as the offer is accepted, and have everything ready at least two working days before the start date.

Gather the inputs from HR and the line manager

IT cannot build a profile without these basics:

Full legal name, start date, department and job title.
Line manager and, if relevant, the buddy or team lead.
Employment type: permanent, contractor, intern or articled candidate. Each may need different access and a different end date.
Work location: office, hybrid or fully remote. Remote staff need a device that arrives early and a tested connection method.
A check on whether this person already exists in your directory, for example a returning employee or a former contractor. Duplicate or stale accounts are a common source of mess.
The role profile to copy, or a list of the systems the role needs.

Decide the devices

Choose the laptop or desktop, monitor, headset and any extras. Engineering roles often need a workstation with a stronger graphics card and more memory for CAD and modelling software. Finance roles usually need a standard business laptop with disk encryption turned on and a screen privacy filter if they work in shared spaces.

Before the device ships or is handed over:

Install the operating system, patches and your standard software set.
Enrol the device in your management tool, so you can apply policies, locate it and wipe it if it is lost.
Turn on full-disk encryption and the endpoint protection agent.
Label it and log the serial number in your asset register.

If your firm leases rather than buys devices, a hardware as a service arrangement can make the supply and replacement of these machines part of one monthly cost, which simplifies ordering for each new hire.

Create accounts and licences

Create the identity first, then everything else hangs off it:

A user account in your directory with your standard naming convention.
A mailbox and the right Microsoft 365 licence for the role. Not every person needs the same plan, so match the licence to what they will do.
Membership of the correct security and distribution groups.
Phone extension or softphone, if you use one.
Line-of-business accounts such as your accounting, portfolio, CRM, time-recording or project-management systems.

A temporary password should be unique, delivered through a separate channel from the username, and forced to change at first login.

Granting access: roles, least privilege and MFA

The quickest way to create a security problem is to copy another person’s account permissions “because they do the same job”. Over months, that person has collected access they no longer need, and your new hire inherits all of it.

Build access from role-based groups

Define a role profile for each job family, then assign permissions through groups rather than to individuals. One practical write-up describes the logic well: a role-based approach means one role instead of dozens of individual accounts and permissions. For a financial services firm, that might mean groups such as Advisers, Compliance, Operations and Finance. For an engineering firm, groups by discipline (civil, mechanical, electrical) and by project.

For each role, write down two lists:

Core systems every person in the role gets automatically.
Additional access that needs a named approver, such as a restricted client folder or a project that has a confidentiality clause.

Project-based access in engineering deserves special attention. Add people to a project group when they join the project and remove them when it closes. Do not leave it to memory.

Keep privileged access narrow

Administrator rights are the highest-risk item on any onboarding list. Guidance from the UK Information Commissioner’s Office, which is a useful benchmark even though it is not South African law, says that responsibility for granting privileged access should rest with a specific senior person so that accountability is clear. The same page recommends restricting write access to privileged staff or designated owners and using MFA for sensitive systems.

In practice:

New starters never get local administrator rights by default.
Anyone who needs elevated rights gets a separate admin account, not their daily account.
Every privileged grant has a named approver, a reason and a review date.

We cover this in more depth in our guide to privileged access management for modern businesses.

Set up MFA on the new account before the employee signs into email or any client system. Use an authenticator app or a hardware key rather than SMS where you can. Do the enrolment with the employee on day one, and record the backup method they chose. Add MFA to every external-facing system: email, VPN or remote access, cloud storage, and your financial or engineering platforms.

Employee enrolling a phone-based authenticator

If your Microsoft 365 environment is the backbone of your accounts, our note on why Microsoft 365 security is the cornerstone of business protection explains the controls worth switching on.

Security and acceptable-use briefing

Technology controls fail when the person at the keyboard has never been told what to look for. Schedule a short, structured briefing in the first week. Security practitioners recommend covering phishing recognition, incident reporting and data handling so that a security-first habit starts early.

A useful agenda for a 45-minute session:

Phishing and payment fraud. Show real examples. Finance teams should see invoice-redirection and fake bank-detail change requests, which target firms that move money. Engineering teams should see fake file-sharing links and tender or supplier impersonation.
How to report. Give one email address or phone number, and a rule that reporting a mistake quickly is never punished. Speed limits the damage.
Handling client data. Where files may be stored, what may not be sent to personal email or messaging apps, and how to share large drawings or client documents safely.
Passwords and MFA. Use a password manager, never reuse passwords, never approve an MFA prompt you did not trigger.
Acceptable use. Personal use of devices, social media, removable drives, public Wi-Fi and working from home.
Physical basics. Locking screens, clear desks and visitor rules.

Have the employee sign the acceptable-use policy and keep that signature on file. Training should then be repeated; our piece on how often employees should train on cybersecurity helps you set the rhythm, and our staff cybersecurity training guide for IT managers covers how to run it.

For the wider hiring and legal side of bringing someone on, this checklist for hiring your first employee in South Africa sits alongside the IT steps here and helps keep contracts and policies in step.

POPIA: protecting employee and client information

In South Africa, onboarding is a personal-information event twice over. You collect the employee’s own data (ID number, banking details, tax and medical information), and you give them access to client data that you are responsible for.

Section 19 of POPIA says a responsible party must secure the integrity and confidentiality of personal information in its possession or control by taking appropriate, reasonable technical and organisational measures to prevent loss, damage, unauthorised destruction and unlawful access. Your onboarding checklist is where much of that becomes concrete: encrypted devices, MFA, role-based access and logged approvals are all evidence of reasonable measures.

Practical POPIA steps for onboarding:

Collect only what you need. Keep HR documents in a restricted location, not in a general shared folder or an email thread.
Limit who can see employee files. HR and payroll only, through a dedicated group.
Check your operators. If an outside party, such as an IT provider, payroll bureau or cloud host, processes personal information for you, POPIA expects a written contract that makes the operator maintain security measures. Confirm the contract is in place before the new hire’s data or access flows through that provider.
Plan for incidents. Make sure the new employee knows how to report a suspected compromise immediately, so the firm can assess whether it must notify the Information Regulator and affected people.

Financial services firms often carry additional regulator and client expectations on top of POPIA, and engineering firms may have confidentiality clauses in client and project contracts. Ask your compliance or legal adviser which obligations apply to your firm and record them in the role profile.

Remote and hybrid starters

Many South African firms hire people in a different city, or work with remote specialists. A few adjustments help:

Ship the pre-configured device early, with a clear first-login guide and a phone number to call.
Use a secure remote-access method, and confirm it works from the employee’s home connection before day one. Load-shedding and fibre outages are a reality, so agree a fallback such as a mobile data allowance or a UPS for the router.
Schedule the day-one IT session by video, and keep the first two weeks lightly structured with regular check-ins.

For more on running distributed teams well, see our guide to remote team practices for South African businesses.

Day one: what IT should test with the employee

Do not hand over a laptop and hope. Sit with the person (physically or on a call) and run through this list:

Check	What to confirm	Done by
Login	Sign-in works with the new credentials, password changed	IT and employee
MFA	Authenticator enrolled, backup method recorded	IT
Email and calendar	Send and receive internally and externally	Employee
Core applications	Each role system opens and shows only the right data	Employee
Files	Access to correct shared folders, and no access to others	IT
Printing and scanning	Default printer and scan-to-email work	Employee
Remote access	VPN or remote desktop works off the office network	IT
Collaboration tools	Teams or equivalent, with correct channels	Employee
Endpoint protection	Agent running, device encrypted, policies applied	IT
Support	Employee knows how to log a ticket and who to call	IT

The negative test is the one people skip. Ask the employee to try opening a folder they should not see. If it opens, your groups are wrong and it is better to find out now.

South Africa runs on UTC+2 with no daylight saving, which matters when a remote employee’s manager works in another time zone. One onboarding guide advises front-loading contact in the first fortnight for remote staff whose manager is six hours behind, so agree overlap hours early.

Documenting the process

A checklist that is not recorded cannot be audited. Keep one onboarding record per employee containing:

The role profile used and the groups assigned.
The approver for any additional or privileged access, with the date.
Device serial number, asset tag and encryption status.
Licences assigned.
Signed acceptable-use policy and the date of the security briefing.
Day-one test results and who completed them.
Any exceptions and when they will be reviewed.

Store it where HR and IT can both reach it, with access restricted. Then review access at 30 and 90 days. People change duties quickly in a new job, and early review catches over-permissioned accounts before they become permanent.

The same record pays off at the other end of the employment. Our checklist for digital offboarding of employees uses exactly this information to close accounts, recover devices and transfer files cleanly.

Our perspective

Most onboarding problems we see in mid-sized professional firms are not technical. They come from the process living in one person’s head. The IT manager knows which groups to add, the office manager knows which laptop is spare, and when either is on leave the new hire waits.

We build onboarding around a role profile and a written checklist, because that makes the result repeatable and auditable. For finance and engineering firms with 20 to 300 staff, this is where proactive IT management pays off: devices are ready, access is correct, MFA is on, and the client data a new person touches is protected from the first login.

Firms with an internal IT team often keep the day-to-day relationship with staff and bring us in for the heavy lifting, such as device build, monitoring, security and escalation. That is the idea behind our co-managed model. Firms without that team can have us run the whole process under a fully managed arrangement.

Steven

How Techtron can take this off your plate

If your IT manager is stretched, or onboarding still depends on whoever is free, we can run the process with you. Our co-managed IT service, published from R750 per workstation per month, supports an internal IT team, while fully managed IT covers the function end to end. We can also protect the new starter’s data with Microsoft user backup from R70 per month and secure their endpoints and Microsoft 365 accounts through our cybersecurity services. Prices are as published on our site; contact us for a quote that fits your headcount.

FAQ

How long before the start date should IT begin onboarding?

Start when the offer is accepted and aim to have everything ready two working days before day one. Ordering hardware, creating licences and building the device image take the longest, and remote staff need extra time for delivery.

Who is responsible for IT onboarding: HR or IT?

Both, with clear hand-offs. HR supplies the details and confirms the start date, the line manager defines the role’s access needs and approves extras, and IT builds and tests. Assign one person to own the checklist so nothing falls between teams.

Does POPIA apply to onboarding a new employee?

Yes. You process the employee’s personal information, and the employee will access personal information about your clients. Section 19 requires reasonable technical and organisational safeguards, so encryption, access control and MFA are part of meeting it. Ask your legal adviser about obligations specific to your firm.

Should new employees get administrator rights?

No, not by default. Give standard user rights, and add elevated access only with a named approver, a documented reason and a review date. People who genuinely need admin rights should use a separate admin account.

What should we do if a new hire clicks a phishing link in week one?

Tell them to report it at once, without fear of blame, so IT can reset credentials, review the account’s activity and isolate the device if necessary. Then use the case in your next training session.

021 673 6756

Client Portal

IT Onboarding Checklist for South African Firms

TL;DR

Why IT onboarding deserves its own checklist

Before day one: what to prepare