Due Diligence and Ongoing Monitoring

It's a rare scenario, but you definitely need the Board approval and respective business desk approvals. Then you need to identify all data connections (should have been identified at onboarding), make sure your access management terminates all digital and physical access, and make sure the vendor provides an email confirmation that your confidential data has been destroyed. If they shared it with subcontractors, which is likely the case for criticals, I would get a confirmation that those parties destroyed it too, just because it is likely to be scrutinized.