What is the purpose of an exit/offboarding process for vendors?

• A. To renegotiate contracts and pricing.
• B. To revoke access, retrieve assets, and ensure secure data return or destruction.
• C. To onboard additional systems.
• D. To extend the vendor relationship without review.

Answer: (B)

Offboarding a vendor is about securely winding down the relationship to prevent any lingering risk. The key goal is to revoke all vendor access to systems, retrieve assets (like devices, keys, badges), and ensure that any data held by the vendor is returned or destroyed in a controlled, auditable way. This protects against unauthorized access, helps meet data protection and contractual obligations, and provides a clear closure trail for audits. Renegotiating contracts, onboarding additional systems, or extending the relationship without review don’t fit this phase, as they pertain to ongoing or future actions rather than securely closing out the engagement.