Vendor Exit Handover: Data, Access and Open Obligations

Inventory assets and open obligations early

List account and transaction history, configuration, reports, audit evidence, domain and certificate control, integration details, support records and operational documentation. Separate customer-owned assets from licensed components that cannot be transferred. Record the contractual export scope and any required assistance rather than assuming every internal supplier tool is included.

Identify obligations that survive the service end: unresolved payments, client requests, disputes, retention requirements and outstanding defects. Assign an owner and evidence location for each. The UK Government Sourcing Playbook emphasizes planning exit and transition early; its public-sector contract expectations are context, while the actual agreement governs a particular supplier handover.

Verify exports and replacement access

Specify export format, schema, timezone, currency precision, historical range and identifiers. Test whether a recipient can interpret the data and reconcile control totals, not merely open the file. Track incremental changes between the first export and the agreed handover point. Missing adjustments or stable references can make a large archive operationally incomplete.

Create replacement identities and permissions through approved processes. Do not transfer personal administrator passwords as a shortcut. OWASP's secrets-management guidance covers credential lifecycle and rotation; use that principle to plan new credentials, dependency updates and later revocation while preserving an audit trail.

Sequence access withdrawal and final closure

Agree who can declare the handover complete and what evidence they require. Withdrawing access too early can obstruct reconciliation; leaving it indefinitely creates unnecessary exposure. Record a bounded overlap period where justified, with named privileges and monitoring. Rotate shared secrets after the replacement path is verified.

Obtain evidence for data return, retained copies and deletion according to applicable obligations and the contract. Do not promise immediate destruction where a lawful retention requirement applies. Close invoices and subscriptions separately from technical access. Keep a final record of accepted deliverables, unresolved items and the party responsible for each continuing obligation.

Example: a complete export still lacks one operating dependency

A fictional operator receives twelve months of transaction files and reconciles their totals. The domain's administrative contact, however, remains a supplier employee, and an open payout case is referenced only in that employee's mailbox. The handover stays incomplete until authorized domain control and the case record reach their designated owners. Data completeness and operational continuity are checked independently.