The Keys Outlive the Contract: Auditing Supplier Access After a Messy Breakup

Most small organisations treat a supplier change like a switch: old provider off, new provider on. In reality it is more like moving house. The old keys are still in circulation until you collect them.

That is not a criticism of suppliers. It is just how access works. A web developer keeps the registrar login because it was easier. An IT support firm leaves its remote monitoring agent installed because removing it was never in the exit conversation. A backup provider still has a console login because nobody remembered the console existed. The contract ends. The access often does not.

This is a 60-minute exit audit for small UK teams. The 60 minutes is for the audit, not the whole cleanup. You will probably find something that takes longer to fix. That is the point: find it now, not when an old supplier account is used by someone else.

Start with a list, not a feeling

Before you revoke anything, write down every place a supplier could have a login. Do not rely on memory. Use these prompts:

• Domain registrar and DNS hosting
• Website hosting, CMS admin and SSL certificate management
• Microsoft 365 or Google Workspace global admin
• Email filtering, archiving and continuity services
• Remote monitoring and management (RMM) tools
• Backup consoles and storage buckets
• Firewall, VPN and Wi-Fi management
• Password manager admin console
• Phone system and call routing
• Social media, Google Business Profile and review sites
• Accounting, payroll or CRM systems if the supplier touched them
• Any shared mailbox or alias the supplier used

A free password manager report is a useful starting point if your team saves work logins there. Browser saved passwords are a clue, not an authority. The real list should come from admin consoles, invoices, old tickets and the supplier's own handover notes.

Minute 0–10: Build the access inventory

Create a simple spreadsheet with columns: service, supplier, account owner, admin URL, current access, evidence, action, owner. If you use a free tool like a password manager audit report, export it and attach it to the spreadsheet. If you do not have one, a shared document is fine. The important thing is that the inventory exists and has a date on it.

Look for accounts tied to supplier email addresses rather than your own staff. Those are the ones that survive staff turnover. Also look for generic accounts such as admin@, support@ or webmaster@. Generic is not automatically bad, but it needs a named owner inside your organisation.

Minute 10–25: Revoke remote support and admin accounts

Start with the accounts that can reach the most. In Microsoft 365 or Google Workspace, review global admins first. In your RMM tool, review every user and every agent. In your backup console, review who can delete or restore data. In your firewall and VPN, review remote access rules and user accounts.

Do not just disable the account and move on. Record what you did, when, and who authorised it. Screenshot the user list before and after. If the old supplier had a shared admin account, change the password and rotate any API keys or tokens attached to it. If the supplier had a personal account, disable it and confirm the licence is removed.

Be careful with the phrase just in case. Keeping an old supplier login open in case something breaks is how you end up with a back door nobody owns. If you need cover, use a break-glass account that your organisation controls and document who can use it.

Minute 25–40: Recover the front door

Domain and DNS control is the part small teams most often lose. Check who the registrar account belongs to, which email address is used for registrar notifications, and whether the old supplier is listed as a technical or admin contact. If the registrar login is still in the supplier's name, start the transfer or ownership change now. Do not wait until renewal.

Check DNS records for anything you did not expect: old mail servers, leftover verification records, subdomains pointing at supplier infrastructure, or wildcard records. Use a free DNS lookup tool to compare what is live with what you think should be live. If your website or email depends on a supplier-managed DNS zone, ask for an export and confirm you can edit records yourself.

For email, check whether the old supplier can still access mailboxes, change forwarding rules, or manage the email filter. A forwarding rule left behind is a quiet way to keep receiving copies of invoices and password resets.

Minute 40–50: Check the hidden agents

RMM agents are the ones people forget. They sit on laptops and servers, they check in to a supplier dashboard, and they can run commands. Ask the old supplier for a list of installed agents and then verify it yourself on a sample of machines. If you cannot get a list, use your endpoint management tool or a free inventory scan to find software you do not recognise.

Backup consoles deserve the same treatment. The old provider may still be able to restore, delete or download backups. Confirm who owns the backup repository, where the encryption keys live, and whether the old provider has any retention copy. If the answer is vague, treat it as a finding.

Minute 50–60: Get it in writing

Send a short, specific email to the old supplier. Ask them to confirm that all accounts, agents, API keys and remote access paths have been removed; that any credentials or data they hold have been returned or destroyed as agreed; and that they will not attempt to access your systems. Ask for the confirmation by a named person with authority, not a generic support address.

Save that email with your evidence. If the supplier has already gone quiet, document your attempts. A dated record of what you asked, when, and what you changed yourself is better than a vague memory.

What good evidence looks like

Good evidence is boring. It is a dated screenshot of the admin user list after removal. It is a registrar confirmation that the account is in your name. It is a ticket reference for the RMM agent uninstall. It is a signed or emailed exit confirmation from the supplier. Keep it together in one folder and note the date of the audit.

This matters beyond tidiness. If there is ever a personal data incident, your UK GDPR obligations may require a timely assessment and, where appropriate, a report to the ICO within 72 hours. If an insurer or client asks how you manage supplier access, this folder is your answer. It is also useful if you later need to show Cyber Essentials evidence of access control.

If you find something after the handover

Do not panic, but do not sit on it. If an old supplier still has admin access, disable it yourself where you can and tell the new supplier or your internal owner. If you suspect the access was used, preserve logs, change credentials and take advice. The worst outcome is not finding a leftover login. The worst outcome is finding it and leaving it because the conversation feels awkward.

Supplier breakups are rarely clean. The underdog move is to make them auditable. Put 60 minutes in the diary, bring a list, and collect the keys before the old provider decides to use one.