Does your organization have a process to promptly deactivate supplier access to systems and resources when it is no longer required?

Maintaining active access for suppliers after their engagement has ended creates unnecessary security risks. This includes ensuring that temporary vendor accounts, VPN access, cloud resource permissions, and physical access credentials are revoked immediately upon project completion or contract termination. Evidence could include a documented offboarding procedure specific to suppliers, access review logs showing timely deactivation of supplier accounts, or automated notifications/tickets that trigger when supplier engagements end. A comprehensive supplier access management policy with clear timelines for deactivation would also serve as supporting evidence.