Vendor Risk
Vendor access, integrations, credentials, data retention, return/destruction obligations, and offboarding evidence are addressed during termination.
Use this guide to put the control into operation, decide what records to retain, and check that an auditor can trace the evidence back to the work your team performed.
Maintained by GreenHat Security · Reviewed August 21, 2026
When a vendor relationship ends, the company removes every access path and integration, resolves retained data and contractual duties, confirms the final state, and preserves proof of the completed exit.
First SOC 2 program
Have the relationship owner open an offboarding ticket before termination. Inventory the vendor’s accounts, keys, integrations, data, equipment, contracts, and service dependencies; assign each shutdown action; and obtain deletion or return confirmation where applicable.
As the company scales
Trigger coordinated offboarding from procurement or contract status across identity, privileged access, cloud, integrations, finance, privacy, legal, resilience, and asset systems, with automated tasks, due dates, verification, and escalation for incomplete termination duties.
Open the process for contract termination, nonrenewal, replacement, project completion, unacceptable risk, or an individual vendor user’s departure, with an effective end date and accountable owner.
You should end up with: A dated offboarding record linked to the vendor and termination reason.
Identify user accounts, privileged paths, API keys, integrations, network routes, devices, company data held by the vendor, vendor data held internally, contracts, payments, and dependent services.
You should end up with: A complete exit plan with each access, data, asset, and dependency assigned to an owner.
Plan migration, data export, replacement service, customer communication, and rollback or contingency steps before disabling a critical dependency.
You should end up with: An approved transition plan and evidence that required data and configurations were recovered.
Disable vendor identities, keys, tokens, sessions, integrations, remote connections, support access, and physical access, then verify the result in each authoritative system.
You should end up with: Timestamped revocation records and a reconciliation showing no unintended active access remains.
Complete return, export, deletion, retention, confidentiality, equipment, payment, license, and downstream-provider obligations according to applicable agreements and needs.
You should end up with: Data return or deletion confirmation and closure of applicable contractual actions.
Have the business, technical, security, privacy, and legal owners confirm their tasks, update inventories and architecture, stop recurring costs, and retain the final evidence package.
You should end up with: Approved closure with updated vendor status, systems of record, and linked termination evidence.
Build the evidence set in three layers: what defines the control, who approved or reviewed it, and what proves it operated. Collect operating records when the work happens so they remain dated, attributable, correctly scoped, and traceable to the underlying activity.
Before sharing, remove unrelated personal or customer data, never expose passwords, tokens, or secret values, preserve enough source context to authenticate the record, and use the secure exchange approved for the engagement.
Dated proof that the control actually ran, such as tickets, logs, settings, exports, reports, and test results.
Confirm what the record proves
The termination process identified and assigned every access, integration, credential, data, asset, contract, payment, dependency, and record-update action for the vendor exit.
Include this context
vendor and termination trigger
Include this context
effective end date
Include this context
access, data, asset, and dependency scope
Include this context
task owners and due dates
Include this context
completion and verification status
Include this context
closure approvers
Weak evidence to avoid
A three-item checklist to cancel subscription, remove user, and archive contract with no API keys, integrations, data, dependent service, verification, or accountable owners.
Confirm what the record proves
Vendor identities, privileges, sessions, keys, tokens, integrations, and remote or physical paths were removed at termination and verified in authoritative systems.
Include this context
ticket and vendor identifier
Include this context
account, credential, or connection
Include this context
target system
Include this context
requested and completion timestamps
Include this context
implementer
Include this context
verification result
Weak evidence to avoid
A closed remove vendor access ticket that names no accounts, credentials, integrations, systems, completion time, or access-list verification.
Confirm what the record proves
Applicable company or customer data was returned or deleted, with retained copies, backups, downstream providers, timing, and authorized vendor confirmation addressed.
Include this context
vendor and data scope
Include this context
return, deletion, or retained-data action
Include this context
systems, backups, and onward providers covered
Include this context
completion date
Include this context
vendor certifier and authority
Include this context
permitted retention and end date
Weak evidence to avoid
An account-closure email treated as deletion proof without identifying data, backups, downstream copies, retained legal data, completion date, or authorized certifier.
Type 1
Current vendor-offboarding procedure, configured workflow, and complete current exit-checklist structure as of the examination date. Include an applicable vendor exit through verified revocation, data disposition, inventory updates, and closure approval when one exists; if complete queries of procurement, contract, vendor, and access records return no termination occurrence, retain those zero-result queries and walkthrough a representative vendor exit through every configured technical, data, contractual, and approval step.
Type 2
Every vendor relationship, product subscription, contractor-provider engagement, and individual vendor access relationship terminated, expired, not renewed, replaced, or ordered suspended during the review period.
Reconcile expired and terminated contract or procurement records to offboarding cases, then reconcile each case to identities, keys, integrations, payments, data records, and vendor status until all scoped items are verified closed or formally retained.
Use this checklist to prepare for procedures an auditor may perform. The exact steps and sample selection depend on your engagement scope and the service auditor's professional judgment.
Determine whether the control is designed to achieve this result: When a vendor relationship ends, the company removes every access path and integration, resolves retained data and contractual duties, confirms the final state, and preserves proof of the completed exit.
Compare the documented owner with the intended role (Vendor Risk Owner / CISO / Legal), then compare dated records with the stated cadence: Prior to onboarding; periodic based on risk; at least annually for critical/high.
Reconcile expired and terminated contract or procurement records to offboarding cases, then reconcile each case to identities, keys, integrations, payments, data records, and vendor status until all scoped items are verified closed or formally retained.
Current vendor-offboarding procedure, configured workflow, and complete current exit-checklist structure as of the examination date. Include an applicable vendor exit through verified revocation, data disposition, inventory updates, and closure approval when one exists; if complete queries of procurement, contract, vendor, and access records return no termination occurrence, retain those zero-result queries and walkthrough a representative vendor exit through every configured technical, data, contractual, and approval step.
Every vendor relationship, product subscription, contractor-provider engagement, and individual vendor access relationship terminated, expired, not renewed, replaced, or ordered suspended during the review period.
Dated proof that the control actually ran, such as tickets, logs, settings, exports, reports, and test results.
For each selected record, confirm it demonstrates The termination process identified and assigned every access, integration, credential, data, asset, contract, payment, dependency, and record-update action for the vendor exit.
For each selected record, confirm it demonstrates Vendor identities, privileges, sessions, keys, tokens, integrations, and remote or physical paths were removed at termination and verified in authoritative systems.
For each selected record, confirm it demonstrates Applicable company or customer data was returned or deleted, with retained copies, backups, downstream providers, timing, and authorized vendor confirmation addressed.
Use the categories that apply to this control: connect any policy or design artifact to its approval or review record, then trace a selected operating record through execution, result, and any exception or remediation.
These identifiers help you navigate related Trust Services Criteria. They do not reproduce the criteria or prove that this control fully addresses them in your environment.
Confirm final scope, mappings, and testing expectations with your service auditor. SOC 2® is an AICPA trademark; GreenHat Security is not affiliated with or endorsed by AICPA.