In the event of imminent bankruptcy, closing of business, or retirement of service, will you provide 90 days for customers to get their data out of the system and migrate applications?

Buyers asking this need reassurance about data portability if your business winds down, specifically a guaranteed window to extract data and migrate applications before the lights go out. It specifically wants to know if you will provide customers with a 90-day grace period to retrieve their data and migrate any applications before the service becomes unavailable.

This is being asked in a security assessment because data availability and continuity are critical aspects of security and risk management. Organizations that store their data in your systems need assurance that they won't suddenly lose access to their information if your business situation changes. Without adequate time to retrieve data, organizations could face significant business disruptions, data loss, or compliance violations.

The 90-day timeframe is considered a reasonable standard that gives customers sufficient time to plan and execute data migration projects, which can be complex and time-consuming, especially for large datasets or intricate application dependencies.

To best answer this question, you should:

1. Be clear about your existing policies regarding service termination
2. Specify the exact notification period you provide
3. Explain the mechanisms you have in place for data export
4. Detail any assistance you offer during the migration process
5. Reference any relevant clauses in your service agreements

If you don't currently have a formal policy that guarantees 90 days, consider whether you can commit to implementing one, or explain why your current timeframe is adequate for customer needs.