An organization plans to end its relationship with a cloud-based customer support provider that stores several years of customer records. Which contract provision is MOST important to the information security manager when planning the exit?
Select an answer to reveal the explanation.
Short Explanation
Leaving a provider is like moving out of a rented storage unit: you want your boxes back and proof nothing stayed behind. That's exactly what data return and destruction terms give you. Service credits and fees are about money, and they won't protect a single customer record once you've walked away.
Full Explanation
Exit planning is part of managing external services from the start of the relationship, not an afterthought at termination. The security concern at exit is the organization's information: it must be returned in a form the organization or a successor provider can use, and every remaining copy, including backups and replicas, must be destroyed with evidence that this has happened. Without those terms the provider may retain customer records indefinitely, outside the organization's control and still within its accountability. Service-level credits compensate for poor availability while the service runs; they are a commercial remedy and do not address what happens to the data after the relationship ends. Keeping a security certification valid until the final day gives some assurance during the term but says nothing about return or disposal afterward. A reduced termination fee is purely financial and has no bearing on information protection. Exam caveat: exit terms should also cover transition assistance and the period during which access is revoked, so that service continuity is not lost during the move. Operational check: confirm the contract states the return format and timeline, covers backups and subcontractor copies, and requires a written certificate of destruction.