CCAK: Certificate of Cloud Auditing Knowledge

The agreement should specify how customer data will be returned or securely destroyed, including remaining copies, when services end. Without clear disposition obligations, sensitive data could remain with the provider and be exposed or used without authorization. Retention and security controls also matter, but return and destruction directly address control of the data after termination. (nvlpubs.nist.gov)