Supplier offboarding is the last step in the TPRM lifecycle and is frequently underestimated: incomplete offboarding leaves active access credentials, undeleted data and unfulfilled regulatory obligations.
Supplier offboarding checklist
A complete offboarding includes: (1) access revocation — immediately revoke all systems, VPN access, API keys, (2) data migration — reclaim own data from the supplier, (3) data deletion — confirmation of deletion of all company data, (4) contract completion — outstanding services, warranties, NDA obligations, (5) knowledge transfer — secure documentation and know-how, (6) regulatory notifications — if change is reportable under DORA.
Studies show 20-30% of all data breaches arise from active credentials of former employees or suppliers. Offboarding must be immediate and complete.
Offboarding under DORA
DORA Art. 28(7) requires documented exit strategies that also govern offboarding. For critical ICT service providers, a change may be reportable. Supervisory authorities can request evidence of complete offboarding of ICT third-party providers.
360TPRM maintains a complete offboarding checklist and documents each step in an audit-ready manner — for supervisory authorities and internal control.
FAQ
Design offboarding securely
See in a 45-minute demo how 360TPRM specifically meets your requirements.
Request free demo →