An exit plan that was never executed is a guess

In almost every conversation about vendor risk, someone says early on that there is a backup. That is usually true, and it still answers the wrong question.

A backup protects against data loss. It does not protect against loss of access — and the cases that have actually halted companies in recent years were mostly access cases: an account suspended by an automated check, a failed card payment while the responsible person was on holiday, a contract dispute, an insolvency, a price round with no room to negotiate.

In all of those, the data is intact. It is simply that nobody can reach it, or the software that makes it readable is gone.

What a rehearsal is

An exit rehearsal is the controlled, announced removal of one vendor for a defined window. It is not a stress test aimed at your own staff and not a surprise attack; it is an exercise with a written record.

Four things are fixed in writing beforehand:

Scope. One system, not all of them. On the first run, pick the one whose absence is most survivable — not the most critical one. The insights transfer; the risk does not.

The window. Four hours is enough for a first pass, 24 hours for a result you can rely on. Longer rarely produces new findings and makes sign-off hard.

The abort criterion. What has to happen for the exercise to stop immediately? Write it down beforehand, because you will not decide it cleanly while it is running.

The roles. Who switches off, who records, who decides on aborting, and who informs customers if it becomes visible outside.

Preparation takes longer than the exercise. That is normal, and it is already part of the return: writing it down is when you first notice how many paths lead into that one system.

What comes up every time

Three patterns repeat in nearly every rehearsal.

First: the dependency that hurts is not in the vendor contract. It sits in a small piece of automation that has been running for years — a nightly sync, a script that files invoices, an interface somebody built as a stopgap that has been production ever since.

Second: recovery takes longer than the outage. After switching back on, queues have to be worked off, syncs caught up, error messages cleared. Planning only for the outage plans half of it.

Third: the emergency access is missing or expired. Often it exists but lives in the password manager whose second factor is tied to precisely the device that is currently unreachable.

None of those three findings appears in a contract, a certificate, or a vendor statement. They only become visible once you do it.

The legal backing

Since 12 September 2025, Chapter VI of the EU Data Act applies, and it noticeably changes the starting position for data processing services. Switching charges may only cover costs actually incurred and disappear entirely from January 2027. Notice periods are capped, the transition itself has defined windows, and providers must assist with a switch rather than wait it out.

This is relevant here because a rehearsal asks exactly the questions those rules answer: how fast do I get my data, in what format, and what does it cost? Whoever holds the result of a rehearsal negotiates differently afterwards — and whoever secures an export obligation contractually before it is needed has chosen the cheapest form of an Exit strategy.

The record afterwards

Every rehearsal produces three things: a list of surprising dependencies, a measured number for recovery, and a date.

The date belongs in the table we recommend to clients anyway: one row per critical tool, with product, parent company, owner, last change of ownership, export path, and last successful test export. The final column is the only one you cannot research. You have to earn it.

When a full rehearsal is too much

Then take the small version: one system, four hours, on a quiet Friday afternoon, with two people. Export first, open the export, check whether attachments and history are included, and then try to work for four hours without the service.

That is not a complete exercise. But it is the difference between a guess and an observation — and in a real incident, that difference is the only thing you can lean on.