VNDR-10 Vendor Off-boarding

What is this control about?

The off-boarding process  ensures that contractual obligations are fulfilled and any sensitive data is destroyed. Such examples include ensuring that the vendor can no longer access the system and that they have destroyed any data in their possession. Ensure that all the bills have been paid and issue a stop payment to financial institutions if needed.

Available tools in the marketplace

Available templates

TrustCloud has a curated list of templates internally or externally sourced to help you get started. Click on the link for a downloadable version:

• TrustCloud Off-boarding checklist template

Control implementation

Document an off-boarding checklist that includes but is not limited to the following components:

• ensuring that the vendor can no longer access the system
• ensuring the vendor has destroyed any data in their possession.
• ensuring that all the bills have been paid and issue a stop payment to financial institutions if needed.

Monitor vendor’s lifecycle and for any terminated vendors, ensure that the off-boarding checklist is used to properly end the relationship.

What evidence do auditors look for?

Most auditors, at a minimum are looking for the below suggested action:

• Provide the most recently completed off-boarding checklist along with supporting evidence (access removal, invoice, etc.)

Evidence example

From the suggested action above, an example is provided below.

1. Provide the most recently completed off-boarding checklist along with supporting evidence (access removal, invoice, etc.).

The off-boarding checklist can be completed using the template  and is also available within TrustCloud.

Along with additional artifacts such as:

• Access removal ticket for the vendor
• Final Invoice paid receipts