Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

How do we…

How do we exit a supplier without losing data or access control?

5 decision pointsThe pack behind this answer: Third-Party Security Risk Management

Add to board memo

The short answer

Recommendation
Run the exit from the plan agreed at signature: keep the service running while it moves, get your data back in a usable form, remove every account and connection, then have the supplier delete live data and backups. The exit is finished only on written confirmation of deletion, and you keep the supplier's record.
Reasoning
Whatever starts an exit, the risks are the same: data left with a supplier you no longer control, and accounts or connections that outlive the contract. A transition period means leaving a failing supplier does not stop a critical service, which is why the pack holds firm on it even when you terminate for the supplier's breach. Returned data is checked for completeness before deletion is ordered. Access removal is checked on your own systems instead of taken on the supplier's word. Without written confirmation you cannot show the data is gone.
Considerations
  • Leaving a Tier 1 supplier is decided by the board, or a board risk committee it has delegated to; the management board in a two-tier structure; or executive management where there is no board.
  • The 30 days for live data, 90 days for backups, up to 6 months of transition and 10 working days for confirmation are the pack's defaults. Your own contracts may set different ones.
  • Where no exit plan exists, write one now from what the contract gives you. When to agree any missing terms is a judgement for you and your legal adviser.
  • Deletion covers copies held by the supplier's own subcontractors and sub-processors. If personal data is involved, bring in your Data Protection Officer.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartA supplier contract is ending, or the decision is to leaveDecisionIs it a Tier 1 supplier?StepTake the exit decision to the board or its equivalentDecisionIs there an agreed exit plan?StepWrite the plan now from what the contract gives youDecisionMust the service keep running while it moves?StepUse the transition period to move the serviceDecisionDo you need the data back?StepGet the data back in a usable format, and check itStepRemove every account, connection and credential it hadStepHave live data deleted first, then the backupsDecisionHas the supplier confirmed deletion in writing?OutcomeChase it through the business owner and the contractOutcomeClose the supplier's record with the exit date, and keep it

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 14 steps.

  1. Start

    A supplier contract is ending, or the decision is to leave

    Exits start in several ways: the contract expires, you terminate for a security failure, or an assessment ends in Reject. The risks are the same each time: data left behind with a supplier you no longer control, and accounts or connections that outlive the contract.

    In the pack

  2. Decision

    Is it a Tier 1 supplier?

    Leaving a Tier 1 supplier can stop a critical service, so it is a bigger decision than leaving any other supplier.

    In the pack

  3. Step

    Take the exit decision to the board or its equivalent

    In the pack, the business owner takes a Tier 1 exit to the top body, which decides it. Who that is depends on how you are governed: the board, or a board risk committee it has delegated this to; the management board in a two-tier structure; executive management where there is no board, such as in an owner-managed company. Bring the replacement plan and the timetable, not only the reason for leaving.

    In the pack

  4. Decision

    Is there an agreed exit plan?

    Every Tier 1 and Tier 2 contract should have one, agreed before the service started. It covers how data is returned or deleted, how access is removed, what knowledge is handed over, and a transition timetable. If you cannot find one, answer no.

    In the pack

  5. Step

    Write the plan now from what the contract gives you

    List the data the supplier holds, every account and connection it has, and what the contract says about data return, deletion, transition help and termination. Where the contract is silent, the pack sets no rule: when to agree the missing terms is a judgement for you and your legal adviser. A Tier 1 or Tier 2 contract without an exit plan falls short of rule TP-11, so note that gap in your own records.

    In the pack

  6. Decision

    Must the service keep running while it moves?

    Usually yes where the supplier supports a critical service. The pack's exit clause exists so that leaving a failing supplier does not stop a critical service. If you are not sure, plan for a transition.

    In the pack

  7. Step

    Use the transition period to move the service

    The pack's exit clause keeps the supplier providing the service on the existing terms for up to 6 months at your request, in the pack's default, and cooperating with the replacement. The pack says to hold firm on this even when you terminate for the supplier's breach, which is when you need it most. The replacement supplier goes through intake and tiering before it is engaged.

    In the pack

    See also

  8. Decision

    Do you need the data back?

    You choose between return then deletion, or deletion alone. Return is needed whenever the data lives on in the new service or in your own records.

    In the pack

  9. Step

    Get the data back in a usable format, and check it

    Ask for the data in the commonly used, machine-readable format agreed in the contract. Check that it is complete and loads into the new service before you tell the supplier to delete. A cloud contract that lets you export data at any time makes this easier to rehearse.

    In the pack

  10. Step

    Remove every account, connection and credential it had

    Remove the supplier's accounts, remote support tools, network links and integrations, as soon as the service no longer needs them. Have encryption keys, credentials and devices belonging to you returned or destroyed. Check your own systems for what remains instead of relying on the supplier's word.

    In the pack

  11. Step

    Have live data deleted first, then the backups

    In the pack's defaults, live data is returned or deleted within 30 calendar days of the service ending, and backup copies within 90 calendar days, protected until then. Deletion includes copies held by the supplier's own subcontractors and sub-processors.

    In the pack

  12. Decision

    Has the supplier confirmed deletion in writing?

    The pack expects a written confirmation signed by an authorised officer within 10 working days of deletion being complete. 'Data is deleted in line with our retention policy' is not confirmation.

    In the pack

  13. Outcome

    Chase it through the business owner and the contract

    Without confirmation you cannot show the data is gone. In the pack, the business owner runs the exit with the assessor, so the business owner takes this up with the supplier under the contract's deletion terms. If personal data is involved, bring in your Data Protection Officer. Beyond that, follow your own contract management route.

    In the pack

  14. Outcome

    Close the supplier's record with the exit date, and keep it

    Close the entry in your supplier register with the exit date and keep it; never delete it. Keep the exit record and the deletion confirmation for the period your retention policy sets. They are what shows an auditor that the data was returned or deleted and the access removed.

    In the pack

Practical checklist

  1. For a Tier 1 supplier, take the exit decision to your top governing body with the replacement plan and the timetable.
  2. Find the agreed exit plan, or write one from the contract's data return, deletion, transition and termination terms.
  3. Use the transition period to move the service, and screen and tier the replacement supplier before it is engaged.
  4. Get the data back in the agreed machine-readable format, and check that it is complete and loads before you order deletion.
  5. Remove every account, remote support tool, network link and integration, and check your own systems for what remains.
  6. Have your encryption keys, credentials and devices returned or destroyed.
  7. Have live data deleted first, then backups, and get written confirmation signed by an authorised officer.
  8. Close the supplier's entry in your register with the exit date, and keep it.

Evidence to have ready

  • The exit plan used, whether agreed at signature or written at exit (TP-11).
  • The exit record: data returned or deleted, and every account and connection removed (TP-11).
  • The supplier's written confirmation of deletion, signed by an authorised officer.
  • The closed register entry with its exit date, kept with the exit record for the period your retention policy sets.

Assumptions

  • The supplier has been tiered, and the contract is ending, being terminated, or the assessment decision was Reject.
  • The deletion and transition periods shown are the defaults in the CISO Times third-party pack. Your own contracts may set different ones.

Not covered here