CAIQ v4
Control STA-02
Extractive Review Standard
How to answer 'What is your procedure for offboarding third-party vendors and revoking access?' on a CAIQ
Reviewer Guidance & Pitfalls
Describe the vendor termination checklist: immediate revocation of API keys, deletion of shared credentials, and verification of customer data return or cryptographic destruction.
Example Answer Passing Enterprise Audit
Compliant Response Template
Vendor offboarding triggers immediate API key revocation, cancellation of SSO integrations, and documented verification of customer data deletion in accordance with vendor DPAs (SOC 2, CC9.2).
Filling out a CAIQ or SIG Lite right now?
QuietQuestionnaire automatically drafts answers with citations from your own SOC 2 report, catches contradictions reviewers reject, and locks exports behind cryptographic human sign-off.
Zero spam. 100% confidential. No credit card required.