What it is
Vendor sprawl accumulates over time. A vendor onboarded five years ago for a campaign that ended four years ago often remains contracted (a small monthly line item nobody flagged) and still holds an export of the customer list from the original engagement. When that vendor later suffers a breach, the customer data in scope includes the original list, regardless of whether the vendor is still actively used.
Why it matters
Attackers don't distinguish between a vendor's active data flow and its dormant archive. If the vendor suffers a breach, everything they hold is in scope. Firms that rotate CRM platforms, analytics tools, or e-sign vendors every few years are compounding exposure with every rotation unless they explicitly de-provision and demand data deletion from the retired vendor.
The check behind the finding
List every outside service that holds client or staff data and when it was last used.
Closing it
This is closed by the firm, one vendor at a time: knowing which outside services still hold your data or still have a live connection, and ending the ones no longer used. An outside reading shows the services your domain still points to, and the assessment lists them with the evidence.