A new contact does not prove the old access is gone
When a fulfillment partner changes account managers, the immediate concern is often service continuity. Who knows the open issues? Who approves a special request? There is another practical question: what access did the departing person have to your orders, reports and shared workspaces?
Ask for an access handover alongside the operational handover. This does not require the provider to send passwords or expose private personnel information. It requires enough scoped evidence to establish that authorized people can continue the work and obsolete access has been addressed.
Use a control reference without inventing a certification
NIST SP 800-53's PS-4 personnel-termination control distinguishes disabling system access, revoking associated credentials and retaining access to organizational information formerly controlled by the individual. It leaves the disabling period to the organization. NIST PS-4, printed page 211.
Those distinctions inform the evidence questions below. They do not establish that a particular 3PL is certified, that every control applies to its business, or that NIST prescribes a universal number of hours for this handover. Agree on the applicable policy and timing with the provider.
Review three different access cases
We constructed three desk cases to test the completeness of an evidence request. No provider account was inspected and no access was changed.
| Illustrative case | Useful evidence to request | What that evidence does not establish alone |
|---|---|---|
| A named user in the client portal | A redacted disable event identifying the system and time | Removal from every other system |
| A shared credential the person knew | Confirmation of replacement or revocation, with a responsible owner | Completion merely because the named portal user was disabled |
| Reports or files controlled by that person | Confirmation that an approved successor can retrieve the needed records | That obsolete access has also ended |
The exercise shows why “user removed” is too broad unless the record says which user and which system. It also shows why deleting everything associated with a person can create an avoidable business-continuity problem.
Scope the request to your relationship
Start with the systems that expose your business information: the provider portal, shared reporting spaces, support tools and any direct access your brand granted. Ask the provider to identify additional relevant access it manages internally. An integration's service account may continue to be needed even when the person who set it up leaves; the provider should establish its ownership and credential controls rather than assume the integration must stop.
Use redacted logs or an accountable written confirmation when unrestricted screenshots would reveal other customers' information. Record what was verified and what remains a provider assertion. A policy document explains the intended process; an event record explains what happened in the particular case.
Close both sides of the handover
Name the successor for open operational decisions and for access administration. Confirm that needed reports and case histories remain available under the approved retention policy. Set a follow-up for unresolved systems instead of treating a partially completed checklist as finished.
For future selection, ask how the provider handles departures during busy periods and who audits incomplete removals. The strongest answer connects a defined policy, a specific event and continuing business ownership. A reassuring email without scope leaves the buyer unable to tell what was actually checked.
Related reading
Sources
- https://csrc.nist.gov/CSRC/media/Projects/risk-management/800-53%20Downloads/800-53r5/SP_800-53_v5_1-derived-OSCAL.pdf — accessed 2026-10-23