A business-critical supplier refuses a security audit and refuses an offboarding clause with teardown evidence — what do you require, and what do you build anyway?

## The constraint is the question A principal-level answer here starts by naming what cannot be changed. The supplier is business-critical, which means security cannot end the relationship. The supplier has refused an audit, which means every statement about their controls is an attestation you can never verify. And they have refused a teardown-evidence clause, which means the end of the contract will not produce proof that the tunnel is gone. Those are three organisational facts. Everything technical follows from them. The wrong answer is to escalate the audit demand until it becomes someone else's problem, or to accept the questionnaire and treat the file as closed. Both are common and both are visible in an interview. ## What to require, chosen for winnability and testability Ask for less, and ask for things you can exercise: - **Breach notification within a stated period to a named human**, with a contact you test once a year. An untested contact is a phone number in a document. - **A declared list of the prefixes, hosts, ports and directions the integration uses.** This is not a security control for them; it is the input to yours, and suppliers usually agree because it is engineering detail rather than an audit. - **The unilateral right to disable the tunnel** for a security reason without it counting as your breach of the SLA. This one clause is worth more than an audit right, because it converts a fight during an incident into an action. - **Notification when their own subcontractors change**, if they are a provider whose tenancy touches other customers. - **An end date on the tunnel**, distinct from the end date of the contract, with a renewal that is an action rather than an assumption. When a clause is refused, record the refusal. A documented refusal is the artefact that lets someone senior make a decision; an undocumented one is just a gap you own quietly. ## What to build regardless, because it needs nobody's consent - **A per-partner extranet zone at default-deny**, permitting only the declared flows in the declared direction, with denies logged. - **Accepted routes limited to the agreed prefixes**, and a source filter on the tunnel interface, so what they can reach is decided by your configuration rather than by their announcements. - **A named internal owner per tunnel** — not a team, a person — recorded next to the configuration, because ownership is what makes the annual review happen. - **The termination expressed as a technical artefact.** This is the heart of the leaf: the tunnel that is still up two years after the contract ended is not a paperwork failure, it is the predictable result of an arrangement whose only expiry lived in a document nobody re-read. Give the tunnel a configured expiry that fails closed: a dated rule that must be actively renewed, a peer certificate whose validity matches the term, a scheduled review that disables on no response. Then monitor for tunnels with no traffic and no owner, because those are the ones already orphaned. ## Proving it is gone If they will not give you teardown evidence, produce your own. Decommissioning is done when: the peer configuration is removed from your terminator, the routes toward that partner are withdrawn, the zone policy is deleted rather than disabled, every credential the supplier held inside your estate is revoked, and an alert exists for the tunnel attempting to re-establish. That last item is the one that catches the mistake, because a tunnel that comes back up after decommissioning means a configuration you did not know about still exists somewhere. ## Then take it to somebody who can accept it The part that makes this a principal question rather than a senior one: after the technical work, a residual risk remains that you cannot engineer away — an unassessed estate with a routed path into yours. Security does not own that decision. Write it in one page: what the supplier does for us, what they can reach, what we could not obtain, what we built instead, what remains, and what it would cost to reduce it further (a second enforcement layer, a broker, moving the integration to a data exchange rather than network reach). Take it to the executive who owns the supplier relationship and ask them to accept it by name, with a review date. That is not paperwork theatre. It puts the decision where the authority and the budget are, it gives you a scheduled reason to revisit an arrangement that would otherwise outlive everyone who understood it, and it means the answer to *who signed for this* is a name rather than a shrug. ## Interview framing Show the three-way split — what you require, what you build without asking, what you escalate for acceptance — and make the offboarding expiry a piece of configuration rather than a clause. A candidate who says the words *the tunnel expires, not just the contract* has understood the leaf.