Vendor offboarding checklist for agencies changing technology suppliers

Reference article · 8 min read

Use this checklist when a technology contract is ending, whether it expires on schedule, will not be renewed, or is being terminated. Start as soon as the end date is known, while invoices are still open. IT and contracting staff should work through it together, since most items need one person who knows the system and one person who knows the agreement.

Each item below can be answered yes or no, and each says what to do when the answer is no. A finished checklist should show that the agency holds its own data in a usable form, that every vendor path into agency systems closes on a known date, and that the next supplier can start without waiting on the last one.

Contract closeout and notice

The end date and the notice requirement are confirmed in writing. Read the base agreement and every amendment, since some contracts renew automatically unless notice arrives by a date fixed in the terms. If the date is unclear, or the notice window has already passed, take the contract to purchasing and counsel before sending anything to the vendor.
The provision the agency is acting under is named. Expiration, termination for convenience, and termination for cause carry different notice periods and different vendor obligations. If nobody can say which one applies, settle that question with counsel before notice goes out.
Notice is delivered by the method the contract requires. Use the contact, address, and delivery method named in the notices provision, and keep proof of delivery in the file. If notice went out another way, for example by email alone where the contract calls for certified mail, send it again by the required method and keep both records.
The vendor's transition assistance obligations are written down. Record what the vendor must do after the end date, for how long, at what rate, and under which section. If the contract says nothing about transition, ask for a short written transition agreement and settle it before the final invoice is approved.
Open deliverables, credits, and disputes are listed while invoices are still open. Build the list from invoices, change orders, acceptance records, and the project file. If no list exists, make one and put each item to the vendor in writing before final payment is approved.

Data, records, and documentation

A written inventory of agency data and configuration held by the vendor exists. It should cover production records, attachments, audit logs, reports, archives, interface specifications, configuration settings, and anything held by subcontractors or hosting providers. If the inventory is incomplete, request a written data map from the vendor with a date for delivery.
The export format is agreed in writing and a sample has been tested. Documented, open formats with a published schema can be loaded into the next system. A set of PDFs or printed reports cannot. If the only offer is a closed or undocumented format, ask for structured data while the contract is still in force, and escalate through contracting if the answer is no.
A full export has been received and validated against the live system. Compare record counts, check a sample of records field by field, and confirm that attachments, history, and code tables came across. If validation fails, write down what failed, tell the vendor in writing, and do not sign closeout acceptance or release the final invoice until it is corrected.
Retention obligations are identified before anything is deleted. Check the applicable records retention schedule, any litigation hold, and any recordkeeping condition attached to grant funding. If a hold or a retention period applies, tell the vendor in writing which data cannot be destroyed and when destruction may proceed.
Certified destruction is scheduled to happen after acceptance, not before. Ask for a written certificate that names the production systems, subcontractor copies, and backups it covers, with a completion date. If the vendor will not certify, raise it through contracting and tie it to closeout acceptance.

Access, accounts, and security shutdown

Every vendor account is listed with an owner and a disable date. Include named staff accounts, shared administrative accounts, service accounts, and accounts created during implementation. If the list came from the vendor, check it against your own directory, system logs, and privileged access records before relying on it.
Every remote access path has a documented close date. Cover VPN profiles, jump hosts, site to site tunnels, and remote support tools. If a path has no documented owner or purpose, treat it as active, close it on the agreed date, and record who approved the closure.
Shared secrets are rotated, not only disabled. Rotate API keys, service account passwords, certificates, and integration credentials that vendor staff could have retained. If rotating one would break a production interface, put it in the cutover sequence with a date rather than leaving it out.
Personnel and clearance obligations are closed out. Where vendor staff were screened or cleared to handle criminal justice, federal tax, health, or child welfare information, follow the termination steps in the agreement or policy that governs that access, such as the CJIS Security Policy for criminal justice information, and notify the security contact it names. If nobody can identify the governing agreement or the contact, ask the agency's information security officer or the state agency that authorized the access before closing it out.
A final review confirms no residual connectivity. Check firewall rules, allowlists, DNS records, mail relays, and single sign-on or federation trusts for anything still pointing at the vendor. If something remains, remove it, or record who approved keeping it and until what date.

Continuity and handover

Licenses, domains, and accounts registered on the agency's behalf are held in the agency's name. Domain names, TLS certificates, cloud tenancies, app store accounts, and telephone numbers are common examples. If any are in the vendor's name, start each transfer now and confirm the process and timing with the registrar or provider, since many require the current holder to act first.
Third party services sitting behind the contract are mapped. Payment processing, hosting, messaging, and notification services are often contracted by the prime vendor rather than by the agency. For each one, record whether the agency has a direct relationship. If it does not, decide whether to contract directly or to replace the service, and give that decision a date.
Final invoices are reconciled against deliverables and prepaid periods. Check for maintenance or subscription time paid for and not used, credits owed, and deliverables invoiced but not accepted. If the reconciliation is not finished, hold approval of the final invoice until it is.
A cutover date and a fallback are agreed in writing with the new supplier. A parallel run, or read only access to the old system for a set window, gives the agency somewhere to go if migrated data turns out to be wrong. If neither is available, write down what the agency will do instead: which export file answers questions, who can read it, and who decides whether to delay the cutover.
One named person owns the transition from notice through closeout. That person should be able to give the status of every item on this list on request. If no single owner can be named, name one before notice goes out.
Staff and the help desk know the cutover date and what to tell callers. Write down where users go for the new system, what to say about the old one, and who to escalate to. If no script exists, write a short one covering the three questions most likely to be asked: where to log in, where old records are, and who to call.

What to do with the results

Every item answered no needs an owner and a date. Treat the export validation, retention, and access items as blockers: the end date should not pass while agency records are unverified or vendor credentials are still live.

File the completed checklist with the notice correspondence, the export validation record, the certificate of destruction, and the final reconciliation. That is the set an auditor or a later dispute will ask for. Then carry the gaps into the next solicitation. If the export was difficult, write the export requirement, the format, and the delivery timing into the contract the agency is about to sign.

Where HQT fits

Data migration, integration, and transition planning for agencies changing technology suppliers, including export validation, access shutdown sequencing, and the data return requirements written into the next contract.

Frequently asked questions

How early should an agency start vendor offboarding?

Begin as soon as the end date is known, and for a non-renewal work backward from the notice deadline written into the contract. Data export, validation, and the transfer of domains, certificates, and cloud accounts all take time that is hard to predict, so confirm the timing with each registrar or provider rather than assuming. Starting early also keeps the work inside the period when invoices are still open and the vendor still has obligations to perform.

What if the contract does not say the vendor must return our data?

Ask for the export in writing anyway, and ask before the final payment is released. If the vendor resists, have counsel review the ownership, license, and records provisions, since public records and records retention law may give the agency rights that the agreement does not address. Write an explicit data return and format requirement into the next contract so the question does not come up again.

Should the agency keep access to the old system after cutover?

A period of read only access to the outgoing system is usually worth negotiating, because problems with migrated data often surface only once staff begin using the new system. Put the length, the cost, and the access method in writing before the contract ends rather than asking afterward. If the vendor will not agree, confirm that the validated export is complete enough to answer questions on its own.

Who should own vendor offboarding, IT or contracting?

One named person should own the transition from notice through closeout, with both functions contributing. Contracting handles notice, closeout, and final reconciliation. IT handles the export, the shutdown of accounts and credentials, and the cutover sequence. Without a single owner, the items that sit between the two functions, such as closing vendor access after the final invoice, are the ones most likely to be missed.

What should the agency do if the vendor will not certify data destruction?

Raise it through contracting in writing and tie it to closeout acceptance rather than letting the point lapse. Ask specifically about copies held by subcontractors and hosting providers and about backup retention, since those are the places data is most likely to remain. Confirm first that no litigation hold or records retention requirement makes destruction improper at that time.