[myinitialsaretk]

An agency I worked with handled this liability via a support contract.

It was structured as, pay us for N hours a month of retainer, we will keep your servers patched and secured with updates and maintain all of your credentials.

Otherwise, we don't want the liability of having access to all of your systems, so we need to expire our access and hand it over to someone on your team.

Sometimes the company had an IT dept that had no idea what to do with the info, but would be in charge of keeping it. Or they would be happy to pay for us to stay on top of things.