Which statement describes the objective of an exit/offboarding process?

• A. To extend the contract term automatically.
• B. To revoke access, retrieve assets, and ensure secure data return or destruction.
• C. To increase vendor performance metrics.
• D. To notify customers of the vendor change.

Answer: (B)

Exit/offboarding is about securely winding down a vendor relationship. The objective is to revoke access to all systems, retrieve all assets the vendor may have, and ensure any data held by the vendor is returned or destroyed in a controlled, compliant manner. This protects security and privacy by preventing residual access, ensuring equipment and licenses are recovered, and avoiding data leakage or noncompliant data retention after the relationship ends.

Revoking access removes lingering permissions that could be misused, retrieving assets guarantees you reclaim hardware, credentials, or software licenses, and ensuring secure data return or destruction prevents sensitive information from remaining in the vendor’s control. These steps collectively minimize risk and help maintain regulatory and contractual obligations.

Choices that suggest extending the contract, improving performance metrics, or simply notifying customers do not capture the primary goal of offboarding, which is about securely terminating the relationship and protecting information and assets.