# Secure cloud and supplier exit

An export button may be insufficient at contract end. Formats, attachments, relationships, logs and decryption keys must remain useful elsewhere. This guide distinguishes planned transition from supplier failure and covers portability, rollback, access closure and validated deletion.

Original SecNet educational content with fictional examples, not publication/endorsement by referenced organizations. Page exercise choices last only for the open session; no real organizational data is collected.

2026.10 · 2026-10-21

## What should I do tomorrow?

1. Map data, identity and key dependencies of one critical SaaS service.
2. Read a sample export with relationships and attachments elsewhere.
3. Assess initial steps and costs without provider assistance.

## Concepts

**Çıkış planı** — Controlled steps preserving data and operations when leaving or losing a provider.

**Taşınabilirlik** — Ability to use exported information elsewhere while preserving meaning and relationships.

**Geçiş kabulü** — Acceptance that the destination meets defined business and security criteria.

**Alt işleyen** — Another party in a provider’s processing chain used to deliver the service.

**Çıkış kanıtı** — Trace of transfer, access termination, reconciliation and deletion/preservation decisions.

## Process map

### 1. Map dependencies

Service owner + procurement

Map data, identity, keys and contract boundaries.

Exit scope.

### 2. Design the path

Architecture + business owner

Plan destination, cost, acceptance and rollback.

Approved transition plan.

### 3. Test export

Data owner + technical team

Test format, integrity and usability using synthetic samples.

Repeatable transfer test.

### 4. Validate transition

Business owner + security

Validate transactions and access at the destination.

Acceptance and rollback decision.

### 5. Close access and copies

Provider + organizational owner

Reconcile revocation, deletion or preservation.

Scoped exit evidence.

## Planned exit and supplier failure

A planned transition may receive provider support; insolvency, outage or access disputes may not. Model them separately. Identify alternative services, data access and independent identity/key needs in advance. An exit plan stored only in the unavailable portal is unusable.

Map data, APIs, applications, certificates, DNS, licences and subprocessors of critical services. Review contract end, retrieval windows, support, fees and deletion terms with owners. A generic contract clause does not resolve all technical dependencies.

- [ ] Planned and unsupported exit scenarios are distinct.

Reference: [NIST SP 800-161 Rev. 1 Update 1 — Cybersecurity Supply Chain Risk Management](https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final)

## Preserve meaning during export

Check record IDs, relationships, attachments, versions, access metadata and timezones alongside file counts. Opening a CSV does not demonstrate workflow portability. Validate destination search, relationships and reporting using representative records.

Start with controlled samples without unnecessary duplication. At scale test API quotas, pagination, failed records and retry behaviour. Encrypted exports require key access and future readability. Visible product fields may differ from exported fields.

Three exit acceptance tests

| Subject | Focus | Validation / boundary |
| --- | --- | --- |
| Data | Records, attachments and relationships | Meaningful use at destination |
| Service | Identity, keys and workflow | Representative transaction and rollback |
| Closure | Access, backups and subparties | Scoped revocation/deletion or preservation evidence |

- [ ] Formats and record relationships are tested at the destination.

Reference: [NIST SP 800-161 Rev. 1 Update 1 — Cybersecurity Supply Chain Risk Management](https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final)

## Contractual and cost realism

Clarify data ownership, delivery formats, assistance, fees, windows and subprocessor duties. Include staffing, transformation, integration and parallel operation alongside cloud egress charges. Old estimates may no longer fit increased volume.

Assess privacy, sector and cross-border requirements separately. Moving within one country does not automatically meet every duty: recipients, access, purpose and security change. Do not upload real personal data to test environments before contractual/legal review.

- [ ] Fees, windows, assistance and data duties are recorded.

Reference: [NIST SP 800-161 Rev. 1 Update 1 — Cybersecurity Supply Chain Risk Management](https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final)

## Migration and rollback boundaries

Define transition order and the authoritative record source. Concurrent writes can create duplicate or conflicting transactions. Specify cutover, final synchronization, business reconciliation and stop criteria. Test treatment of new data during rollback in advance.

In a fictional support-ticket migration, matching counts cannot compensate for missing attachments or comment order. Business owners validate representative lifecycles while security tests access and logs. Meet acceptance conditions before closing the source.

- [ ] Acceptance criteria and rollback of new data are tested.

Reference: [NIST SP 800-161 Rev. 1 Update 1 — Cybersecurity Supply Chain Risk Management](https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final)

## Access, copies and deletion evidence

Reconcile API tokens, federation, service accounts, support access, network trust and billing authority. Unplanned early closure can block retrieval or evidence; follow the authorized sequence. Then verify old identities no longer work.

Check which systems, categories, subprocessors and backup cycles a deletion statement covers. Record legal-preservation and required-retention boundaries; do not claim immediate deletion of every copy without evidence. Organizational exports remain subject to local retention/disposal rules.

- [ ] Deletion evidence explains scope and exceptions.

Reference: [NIST SP 800-161 Rev. 1 Update 1 — Cybersecurity Supply Chain Risk Management](https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final)

## Consider exit before purchase

Request sample exports and test usability when evaluating new providers. Review plans after supplier changes, product updates or volume growth. Exit exercises need business and procurement assessment, not only technical review.

Measure tested exits for critical services, last tests, unverified relationships and outstanding revocations. Document existence is not portability. Expose unknown dependencies and steps not tested without provider support.

- [ ] Representative testing demonstrates that the plan works.

Reference: [NIST SP 800-161 Rev. 1 Update 1 — Cybersecurity Supply Chain Risk Management](https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final)

## Common mistakes and better approaches

**Treating a contract clause as a test.** — Validate representative exports and destination use.

**Accepting on matching file counts.** — Test contents, relationships, permissions and workflows.

**Closing all copies on a generic deletion statement.** — Reconcile systems, backups and subprocessors.

## Decision examples and explained answers

### CSV ready

Records exist but attachments and relationships are missing.

**Export succeeded; shut down the source.** — Revisit

Opening a file does not establish usable migration. Closing the source may prevent repair of relationships or retrieval of evidence.

**Validate missing content and destination workflows.** — Supported approach

Owners define required fields, attachments and relationships. Reconcile exports and complete representative destination workflows before acceptance and source closure.

### Generic deletion statement

The provider says data is deleted but backup scope is unclear.

**Declare every copy erased.** — Revisit

A general statement does not identify copies or subprocessors. It is misleading to assume no retention or preservation exceptions remain.

**Request scope, backup cycles and exceptions.** — Supported approach

Map evidence to categories and systems, clarify backup cycles and post-restore deletion behaviour, and track gaps with owners and dates.

### Provider unavailable

The exit plan exists only in the unavailable provider portal.

**Wait for the portal.** — Revisit

The same failure makes both plan and data inaccessible. Unsupported exit and controlled independent copies must be designed beforehand.

**Use independent plans and authorized recovery paths.** — Supported approach

Use independent instructions and authority, operating data/key recovery within tested scope. Escalate gaps to crisis management without unsupported assurances.

## Official references

- [NIST SP 800-161 Rev. 1 Update 1 — Cybersecurity Supply Chain Risk Management](https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final) — Supply-chain risk reference; portability and exit tests are original SecNet teaching.