Vendor Access and Offboarding: Where Access Persists
Vendor access tends to accumulate across identities, SaaS invitations, API integrations, shared documents, support accounts, and recovery paths.
Inventory relationships, not only accounts
A vendor may retain access through a named account, shared administrator identity, guest invitation, integration token, mailbox delegation, shared folder, support portal, or recovery contact. Offboarding needs to look across the relationship rather than disable one visible account.
Assign an internal owner
Every material external access relationship should have an internal business or technical owner who can explain why it exists, what data or systems it reaches, and when it should be reviewed. Access without an owner tends to persist by inertia.
Review after the commercial relationship changes
Contract completion, staff turnover at the vendor, project changes, and replacement of a service provider are all triggers to review access. Security offboarding should be part of the commercial closeout process, not an optional technical cleanup.
Sources and further reading
This is general technical guidance. Apply it to your environment with appropriate authorization, evidence, and incident-specific context.