Securely Decommission Service Providers
Description
Securely decommission service providers. Example considerations include user and service account deactivation, termination of data flows, and secure disposal of enterprise data within service provider systems.
Implementation Checklist
Tool Recommendations
Third-party risk management with automated vendor assessments, continuous monitoring, and risk scoring
ServiceNow · Enterprise subscription
Third-party risk management platform with vendor assessment automation, continuous monitoring, and compliance mapping
OneTrust · Enterprise subscription
Security ratings platform providing continuous monitoring of vendor cybersecurity posture with data-driven risk scoring
BitSight · Enterprise subscription
Cybersecurity ratings and third-party risk management platform with continuous monitoring and vendor assessment automation
SecurityScorecard · Enterprise subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Former Provider Retains Active Access to Enterprise Systems
ConfidentialityAfter contract termination, a former service provider's service accounts and VPN credentials remain active, providing continued access to enterprise systems because no decommissioning process revoked access.
Sensitive Data Persists in Former Provider's Environment
ConfidentialityEnterprise data including customer records and intellectual property remains in a decommissioned provider's systems indefinitely because no secure disposal was performed during offboarding.
Data Flow Continues to Decommissioned Provider
ConfidentialityAutomated data feeds continue sending sensitive information to a former provider's systems after contract termination because data flows were not terminated as part of a decommissioning process.
Vulnerabilities (When Safeguard Absent)
No Formal Service Provider Decommissioning Process
Without a decommissioning process, user accounts, service accounts, API keys, data feeds, and network connections associated with former providers are not systematically revoked or terminated.
No Verification of Enterprise Data Disposal by Former Providers
Absence of a decommissioning process means the organization cannot verify that former providers have securely destroyed all enterprise data from their systems after the relationship ends.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Configuration screenshots or exports showing protection controls enabled | Captured quarterly |
| Document | Procedure documentation for protection measures | Reviewed annually |
| Record | Third-party risk assessment reports and scorecards | Annually per vendor |
| Document | Vendor contracts with security requirements | Per contract cycle |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |