IT Onboarding Checklist for New Hires — SMB Guide and Costs

IT onboarding is the set of steps that gets a new employee's PC, accounts, access rights and security rules ready so they can start work safely on day one. In short, work backward from two weeks before the start date and make everything "ready to hand over" by the day before. For a small business, the initial cost per person is roughly 150,000 to 250,000 yen including the PC, with running costs of a few thousand yen per month. Companies without a dedicated IT person tend to improvise each time, but once the steps are written down as a checklist, general affairs staff or a part-time IT owner can run the process without gaps. It is the counterpart of the offboarding IT checklist: the records you create at onboarding are what make it possible to recover equipment and remove access cleanly when someone leaves.

In small companies, HR, general affairs and the hiring manager are each busy with their own tasks between the offer and the start date, so IT setup often begins on the morning of day one. Companies that hire only a few people a year tend to rely on one person's memory, and nobody recalls how it was done last time. The typical results look like this.

- The PC is not ready on day one: the new hire sits idle for several days
- Shared or borrowed accounts: the new hire starts work using a colleague's ID or a shared login
- Over-broad permissions: access to every folder and system is granted "just in case"
- Skipped security briefing: rules are mentioned verbally, with no signed pledge or record
- No asset register: nobody knows what was lent to whom, so items go uncollected at exit

None of these require advanced technology. They are problems of sequence and record keeping. Below we cover the timeline, cost estimates, role assignments, common mistakes and how to turn the process into a template.

The fundamentals of accounts, passwords and MFA are covered in account, password and MFA management for small businesses. This article focuses on how to apply those basics at the moment someone joins.

Plan backward from the start date. PC procurement and account issuance take the longest because of delivery times and approvals, so begin them as soon as the hire is confirmed.

Start by listing the environment the person's job requires. An office administrator, a salesperson and a designer need different PC specifications and software. Resist the urge to simply copy the predecessor's setup. Deciding by job role is the first step toward avoiding excessive permissions later.

Typical purchase and setup costs are covered in PC kitting cost guide for small businesses. Even with only a few units, it helps to compare outsourcing fees with the internal hours required.

Once the device arrives, apply the settings you want standardized, known as kitting. The main work includes OS updates, disk encryption, antivirus installation, required software, and network and printer settings. At the same time, create the email and Microsoft 365 or Google Workspace accounts.

- One account per person: never let anyone use shared or borrowed IDs
- Treat the initial password as disposable: force a change at first sign-in
- Require MFA from the start: it sticks better than adding it later
- Do not grant admin rights: set up regular users as standard users
- Encrypt the drive: enable BitLocker or an equivalent on Windows
- Draft the permissions: list which folders and SaaS the person will use at this point

When creating accounts, also decide which device will be used for MFA, such as the person's own smartphone, before day one. If personal phones are used for authentication, confirm the person's consent and document the rule.

The most common mistake is "we do not know what they need yet, so give them everything." Adding permissions later is easy, but removing excess permissions is hard, because nobody complains and they stay forever.

Least privilege does not mean restricting so much that work stops on day one. Start with what the job directly requires, then check at one week and one month for what is missing and what is unused. Build these review points into the checklist.

When issuing a company smartphone to sales or field staff, enroll it in mobile device management (MDM) before handing it over. This enables remote lock and wipe on loss, enforced passcodes and app restrictions. How MDM works and how to choose is summarized in the MDM guide for smartphones and tablets.

The day before is for confirming that the setup works as soon as it is handed over. Sign in with the new hire's own account and try sending email, joining chat, opening shared folders and printing. Testing with an administrator account hides missing or excessive permissions, so always test under the same conditions as the new hire.

At minimum, the register should record the device type, serial number, asset tag, loan date, borrower and account name. If it is recorded at onboarding, you do not need to research what to collect at exit. For how to build and run a register, see getting started with IT asset management.

Day one is not only about handing over a PC. It is the first chance to help the person understand how to use it safely. Skipping the briefing leads to "nobody told me" later. About 30 minutes is enough if you focus on the essentials.

- First sign-in and initial password change: do it with the person, and tell them never to share the new password
- MFA registration: set up the authenticator app together on the spot
- Password management: no reuse, and use the method the company approves, such as a password manager
- Spotting suspicious email and links: show real phishing examples and ask them to consult before opening anything doubtful
- Data handling: no moving company data to personal USB drives, cloud storage or email
- Loss or theft: explain whom to contact and make clear that reporting promptly will not be punished
- Security pledge: have the person read the rules, sign, and keep the document on file

A security pledge is not absolutely binding in a legal sense, but it serves as evidence that the person understood the rules and raises awareness. A simple format is fine. What matters is recording the date and content of the briefing.

Onboarding does not end on day one. Once real work begins, both missing permissions and unused ones become visible. Make it a habit to review with the manager once within a week and again after a month.

These review records become the starting point for offboarding. If you record everything from joining to leaving as one flow, the exit process becomes a matter of reading the register, collecting items and disabling accounts. See the offboarding IT checklist for the details.

The PC accounts for most of the cost of IT onboarding. The figures below are rough estimates based on typical market prices as of 2026 and vary by model, contract and timing. Confirm actual prices with each vendor.

As a guide, buying a new PC puts the initial cost, including kitting and peripherals, at roughly 150,000 to 250,000 yen. Monthly running costs for email and office software, MDM and antivirus together come to a few thousand yen up to about 10,000 yen. Reusing a returned PC after a wipe lowers the upfront cost considerably. Check support expiry and performance on older machines, and always wipe them first so that a predecessor's data is not handed over.

The biggest cause of delay is the assumption that someone else is handling it. Decide owners in advance and put a name next to each checklist item. In companies without IT staff, it is realistic for general affairs to be the contact point and outsource only the technical work.

If one person handles IT on the side, carving out the work that can be outsourced reduces the burden. PC kitting in particular is routine even for a few units, so compare the vendor's price with your own hours.

The mistakes that actually happen at onboarding are fairly predictable. Knowing them in advance prevents most of them.

All of these can be prevented by onboarding records and minimal permissions. A register and tidy permissions in particular cut exit-time risk substantially without adding much daily workload.

The fewer people you hire per year, the more a written procedure is worth. Companies that hire often learn the steps naturally, but a task performed once or twice a year is forgotten by the next time. A written procedure also makes handover easy when the person in charge changes.

- Put the checklist on one page: rewrite the timeline above for your own company
- Create templates by role: base templates of software and permissions for office, sales and technical staff
- Record on-screen steps: keep screenshots of account creation and permission setup
- Update it at every hire: reflect any stumbling points right away
- Record completion dates and owners: so it can be used for audits and exit checks
- Decide where it is stored: a shared location anyone can open when the owner is absent

The benefit is not only faster preparation. Doing it the same way every time keeps the security level the same for every new hire. Ad hoc handling makes permissions and the depth of security briefings vary with the experience or mood of whoever is in charge.

IT onboarding is the work of creating a smooth first day for a new employee and, at the same time, the starting point for protecting company information. Order devices and create accounts from two weeks before, finish testing and register entries by the day before, give the security briefing and collect the pledge on day one, and review permissions after one week and one month. With this flow as a template, even a company without dedicated IT staff can keep it going. The loan register and account list in particular make the exit process far easier. A good first step is to rewrite the checklist in this article for your own company.