GV.SC-10 asks that your supply chain risk management plans include provisions for activities after a partnership or service agreement ends. The risky part of a supplier relationship is often the tail: forgotten accounts, data left on their systems, and software that quietly stops getting patches.
CSF is voluntary guidance and there is no CSF certification.
What good looks like
For each critical supplier you can answer four questions. How do we leave if it goes well? How do we leave if it goes badly? Who removes their access, and by when? How do we know our data is returned or destroyed?
How to implement it
- Add an exit section to the supplier record: data held, accounts and integrations, contract notice period, and the alternative you would move to.
- Write a standard offboarding checklist: revoke SSO and API keys, remove network allow rules, rotate shared secrets, confirm deletion or return of data in writing.
- For software and components, track end of life dates and set a reminder six months ahead so replacement work is planned.
- Test the adverse case on paper once: the supplier is acquired, fails, or cuts you off on short notice.
- Review supplier access quarterly so ended relationships do not leave live credentials behind.
A worked example
A team ends its contract with an analytics provider. The offboarding checklist runs the same week: the SSO application is removed, the API key is revoked and replaced in the two services that used it, the tracking script is deleted from the web application, the firewall allow rule is removed, and a deletion request is sent to the provider for the exported data. Thirty days later the provider confirms deletion in writing, and the confirmation is attached to the supplier record before it is archived.
Evidence to collect
- The offboarding checklist and completed copies for past exits.
- Written confirmation of data deletion or return.
- A dated record of access removal.
- An end of life tracker for key components.
Common gaps
- Contracts end but integration tokens stay active for years.
- Nobody asks the supplier to certify deletion.
- End of life dates are known to engineers but not tracked anywhere leadership can see.
Quick check
Does this only apply to vendors we fire?
No. It covers normal expiry, mergers and sudden failure too. Those are the cases where having a plan matters most.
Sources
- NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
