The Vendor Offboarding Checklist Nobody Runs

Companies spend real effort onboarding vendors: security reviews, contracts, access setup. Far fewer spend any effort ending the relationship. The contract lapses or is not renewed, the invoices stop, and the vendor's login, data copies and integrations quietly stay in place.

That leftover access is a risk nobody owns. A former vendor can still hold customer data, still have credentials, and still be a way in.

This guide gives you a short offboarding checklist that ends with evidence, not assumptions.

Key takeaways

• Ending a vendor relationship is a security event, not just a finance one.

• Revoke every form of access: accounts, keys, network paths and integrations.

• Ask for written proof that data was returned or deleted.

• Close the contract formally and record a final risk note.

• Keep the evidence, because you may need it later.

Step 1: Revoke every kind of access

List what the vendor can reach: user accounts, administrator accounts, API keys, service accounts, network connections, shared folders and any connected systems. Remove each one and record who did it and when.

The accounts you remember are the easy part. Check integrations and scheduled jobs, because those often keep working long after the contract ends.

Step 2: Get the data back or get proof it is gone

Decide what the vendor holds and what you need returned. Then require one of two outcomes for the rest: a return in a usable format, or written confirmation that it has been deleted.

For what "deleted" should mean, NIST's guidelines for media sanitization describe sanitization as rendering access to target data infeasible for a given level of effort. Naming that standard in your request gives both sides a shared definition.

Step 3: Close out the contract formally

Confirm the end date in writing, settle outstanding invoices and obligations, and note any clauses that survive termination, such as confidentiality and data handling.

The checklist below captures the evidence worth filing. The entries are illustrative.

Item (illustrative)	Evidence to file	Owner	Done?
Accounts and keys revoked	Screenshot or log showing removal, with date	IT lead	To check
Integrations disabled	List of connections with removal confirmation	IT lead	To check
Data returned or deleted	Return receipt or signed deletion certificate	Vendor manager	To check
Contract closed	Written confirmation of end date and surviving terms	Legal	To check
Final risk note	One-paragraph summary of lessons and open items	Risk lead	To check

Step 4: Write the final risk note

Record what you learned: what the vendor did well, what went wrong, what remained open at the end. If you onboard a similar vendor later, this note shortens the review.

For wider vendor oversight, the 30-day reset plan for vendor oversight covers how to keep an accurate vendor list so nothing is missed when an end date arrives.

Frequently asked questions

When should offboarding start?

As soon as a vendor relationship is going to end, ideally before the contract expires, so access removal and data return are planned rather than rushed.

What if the vendor will not confirm deletion?

Escalate through the contract and legal. Record the refusal as an open risk, and limit what data the vendor still has. Include deletion proof requirements in future contracts.

Who should own vendor offboarding?

The business owner of the relationship, with IT handling access removal, legal handling the contract and risk keeping the record.

Do we need to offboard small vendors too?

Yes, in proportion. A short version of the checklist is enough for low-risk vendors, but any vendor with access to company data should get the full process.

A Defensible Next Step

Look at the vendors whose contracts ended in the past year and check whether any still have access. That one check usually finds something. Book a Decision-Clarity Call if you want help building the process.