Exit plans are security controls
Knowing how you would leave a supplier is part of being able to respond when something goes wrong with them.
If the answer is that you could not, then their outage, their breach or their price rise are all things you have to absorb. Exit planning is usually filed under commercial resilience and it determines your options during a security incident involving that supplier.
More on Third-party risk
- Security clauses need operational follow-throughWire the clause to something
- Shared responsibility should name the seamName the join
- Supplier notification affects your response clockThey hold your start button
- Privileged vendors deserve privileged controlsSame review, very different reach
- CI/CD secretsIt has to reach everything
- SBOMsThe list, and the verdict