TPRM Professional Lab - Kestrel Payments Renewal and Exit
The Renewal and Exit Lab is a free advanced third-party risk simulation in which you decide a payment processor's renewal inside a closing notice window, run a controlled exit, and finish with a verified certification of completion.
Sign in to open the lab
TPRM Labs are free for every registered learner. Create an account or sign in to run the Kestrel Payments renewal and exit and earn your Lab Certification.
What this TPRM lab is
The Renewal and Exit Lab is a free advanced third-party risk simulation in which you decide a payment processor's renewal inside a closing notice window, run a controlled exit, and finish with a verified certification of completion.
Most third-party risk training stops at approval. The expensive failures happen at the other end of the lifecycle: auto-renewals signed on price, notice windows missed by a week, exit plans written for the first time on the day of termination, regulated data left at a processor with no live contract, and integration credentials still active years later.
You act as senior TPRM analyst at a retail group whose card processor auto-renews in 74 days unless notice is served. The last full reassessment was four years ago, the agreement predates your clause standard, the vendor has changed ownership and moved platforms into a region you never assessed, and it holds six years of transaction, chargeback and dispute records. Commercial wants the discount. Payments leadership has already chosen a successor.
You reassess what changed, read the contract as if you had to enforce it tomorrow, weigh the risk case against commercial pressure and a hard clock, build a phased exit with rollback conditions, execute termination as an evidence exercise, and separate obligations that survive from those that end. Seven stages, seventy decisions, roughly 55 to 70 minutes in the browser, free for every registered learner.
- Level
- Advanced
- Time to complete
- 55 to 70 minutes
- Cost
- Free, account required
What you will practise, stage by stage
Each stage covers a decision that programmes usually discover too late, when the notice window has already closed.
Stage 1 - Reassessment at renewal
You separate what changed in the service from what changed at the vendor, from new obligations you now carry, from what is unchanged and simply needs re-evidencing after four years.
Stage 2 - Contract gap analysis
You separate rights you genuinely hold from rights written but unenforceable, from protections missing entirely, from terms that actively work against you such as automatic renewal on silence.
Stage 3 - Renewal decision and the notice clock
You keep the risk case for exit apart from real commercial pressure, from the timing constraints that shape what is possible, from options that should be ruled out - including signing an extension to buy time.
Stage 4 - Exit and transition planning
You sequence a dual-run migration, list the data and artefacts you must retrieve, expose hidden dependencies such as configuration living only in the vendor's console, and define pause and rollback conditions.
Stage 5 - Termination execution and destruction evidence
You separate formal contractual steps, access revocation, destruction evidence across primary, replica, backup and subcontracted copies, and the records you are legally required to retain rather than delete.
Stage 6 - Obligations that survive termination
You split what still binds the vendor, what still binds you, what monitoring continues after cutover while they still hold data, and what genuinely ends on the last day.
Stage 7 - Programme lessons and clause uplift
You convert the experience into a clause standard, lifecycle process changes, register and reporting requirements, and the one-off arrangements that are not programme rules.
Skills and deliverables you walk away with
The lab produces the artefacts a renewal and exit file is judged on during an audit or a regulatory review.
A renewal reassessment
Six years of change split into service change, vendor change, new obligations and stale evidence.
A contract gap analysis
Enforceable rights, unenforceable rights, missing protections and adverse terms identified explicitly.
A defensible renewal decision
Risk case, commercial pressure and timing constraints separated, with rejected options stated and reasoned.
A tested exit and transition plan
Phased sequencing, retrieval list, hidden dependencies and measurable rollback triggers.
A termination evidence pack
Formal steps, access revocation, certified destruction across all copies, and retention carve-outs.
A surviving obligations register
What binds the vendor, what binds you, and what oversight continues after cutover.
A clause standard uplift
Data return, notification windows, transition assistance and liability carve-outs made mandatory for future contracts.
Who should run this lab
This lab is written for practitioners who own contracts, renewals and exits rather than only onboarding assessments.
Senior TPRM analysts and managers: You own renewals and want the exit half of the lifecycle practised before you need it.
Operational resilience and exit planning teams: Tested exit plans, substitutability and dual-running are the core of the scenario.
Procurement and contract managers: Notice windows, auto-renewals, transition assistance and liability caps are all worked directly.
Privacy and data protection practitioners: Data return, certified destruction, retention duties and post-exit subject access all feature.
Auditors and second-line reviewers: You test whether exits were evidenced, and this lab shows what adequate evidence looks like.
Professional Lab graduates: You handled the crisis scenario and want the planned, contractual counterpart.
How the lab is scored
You complete the lab only when all seventy decisions sit in the area a senior practitioner would defend, with unlimited retries and no timer.
Wrong placements are rejected with a coaching prompt that sharpens your reasoning without revealing the answer. The lab rewards precision on distinctions that decide real exits: a right written but unusable is not a right, retention is not deletion, and an obligation that survives is not one that ends.
Cards and assessment areas reshuffle on every attempt and every reload, so completion reflects judgement rather than recall.
In the end you get a verified certification of completion
Complete all seven stages and LearnTPRM issues you a verifiable TPRM Professional Lab Certification of completion, free of charge, with a unique certificate ID any employer can check on the public verification page.
There is no fee, no exam booking and no upsell. The credential is issued by LearnTPRM.com the moment the lab is completed inside your account.
Each certificate carries your full name, the lab title, the level, the award date and a unique certificate ID. Anyone - a recruiter, a hiring manager, an audit lead - can paste that ID into the public verification page and see whether the credential is genuine. You can download the certificate as a high-resolution PDF or PNG from your dashboard at any time and attach it to a CV or a LinkedIn profile.
Frequently asked questions
What is a third-party exit plan and why does it matter?
An exit plan documents how you would move off a vendor without disrupting the service: sequencing, data retrieval, dependencies, timelines and rollback conditions. It matters because an untested exit means you cannot leave a failing or non-compliant vendor at acceptable cost, which is exactly when you most need to.
What should vendor offboarding include?
Formal notice and governance records, retrieval of data and artefacts in a usable format, revocation of every credential and connection, certified destruction covering primary, replica, backup and subcontracted copies, retention of records you are legally required to keep, and a register of obligations that survive termination.
Why are auto-renewal notice periods a risk?
Because they bind you by inaction. If notice is not served inside the window, the contract renews on the vendor's terms regardless of assessment findings, so notice dates need to be register fields with alerts, not something an analyst remembers.
What is a certificate of destruction, and what makes it adequate?
It is written confirmation that data has been destroyed. It is adequate only when it names the data scope, the method, the dates and every copy - primary, replicas, backups and any subcontracted archive - rather than being a general assurance.
Is this lab advanced?
Yes. It assumes you already understand tiering, due diligence and residual risk, and it tests contractual judgement, timing pressure and evidence discipline.
How long does it take?
Around 55 to 70 minutes, with no time limit and progress kept for your session.
What outcome is considered correct?
Serve notice and run a phased dual-run exit with rollback triggers, full data retrieval before access revocation and certified destruction afterwards. Renewing for the discount and cutting over abruptly are both wrong.
Does it cover obligations that continue after a contract ends?
Yes. A full stage separates vendor confidentiality, breach notification and enquiry cooperation from your own retention, subject access and chargeback tail duties, plus the monitoring that continues while the vendor still holds wind-down data.
Is the certification free and verifiable?
Yes. It is free, carries a unique certificate ID, and can be verified publicly on the LearnTPRM verification page.
Can this be used as an exit-planning reference at work?
Many practitioners use it that way. The stage structure mirrors a defensible exit file, and the paired templates hub provides offboarding checklists you can adapt.
Related TPRM learning
- TPRM Professional LabManage a live fourth-party compromise at a regulated bank.
- TPRM Monitoring LabTriage a live monitoring queue across a 412-vendor portfolio.
- All TPRM LabsThe full scenario-based lab library and what each one trains.
- TPRM Templates and ChecklistsFree offboarding checklists, exit plans and assessment templates.
- TPRM Warrior Professional CertificationThe free professional certification exam that pairs with this lab.
Founding SponsorAutonomous TPRM. 90% less manual effort.
Now see the same case run by AI agents
The lab put you inside a real vendor file: intake, inherent risk, diligence, findings, remediation, residual risk, approval. Every judgement you made is a step the SAFE TPRM AI Co-Worker executes autonomously - which is why practitioners who finish these labs tend to bring it to their employer.
This is for you if you own a third-party risk program - roughly 100+ vendors, quarterly reassessments, DORA / NIS2 / OCC pressure and no new headcount coming. The link opens Safe Security's platform page, not a gated form.
Trusted by 10% of the Fortune 500, and named a Leader in Liminal's TPRM Link Index.
- Intake and inherent risk scored instantly, with scope and relationship context mapped for you.
- Findings become context-rich remediation tasks with evidence, business impact and clear guidance.
- The Risk Validation agent confirms risk actually dropped before closure.
For security and risk leaders assessing a TPRM platform. Opens safe.security in a new tab.
25+
AI agents
90%
Less manual effort
None
Additional headcount
200+
Organizations globally
End to end
Intake to offboarding