24. What should we require for GRC data portability and exit?

Require a demonstrated, reconcilable export of the information needed to continue the programme—not merely a CSV of current records. Federal banking guidance specifically highlights termination planning, data retention/destruction, system connections and the resources needed to transition a third-party activity. Federal Reserve community-bank guide. (federalreserve.gov)

Our proposed exit package includes:

• Records, stable identifiers and relationships.
• Evidence files and attachment manifests.
• Relevant assessments, approvals and change history.
• Users, owners and access classifications needed for reconstruction.
• Field definitions, taxonomies and calculation descriptions.
• Workflow and configuration documentation.
• Retention decisions, legal holds and archive arrangements.

Treat export capabilities separately. IBM, for example, documents an export of selected object types and relationships into CSV files; that statement alone does not demonstrate a complete historical exit package. OpenPages export documentation. (ibm.com)

Before signing, export a representative sample and have a different team reconstruct the relationships without using the vendor’s interface. Before termination, reconcile the complete agreed export and test archive retrieval.

Negotiate access duration, export frequency, assistance rates, format documentation, deletion arrangements and responsibilities for inaccessible historical material. Agree how backup deletion differs from deletion from the live service.

Acceptance condition: the organisation can explain what it can take, what it cannot take, how remaining information will be retained and what each step costs.