Relevant suppliers are included in incident planning, response, and recovery activities

Implementation steps

1. 1

   Identify suppliers that must be involved in incident scenarios

   For each major incident scenario in your incident response plan, identify which suppliers would need to be notified, engaged, or whose access would need to be revoked. A ransomware event might require contacting your managed security service provider and cloud provider. A data breach involving a SaaS tool requires notifying that vendor and possibly involving them in investigation.

   confluencenotion
2. 2

   Include supplier contact information and procedures in the IR plan

   For each relevant supplier identified above, document: the emergency contact name and number, the contractual notification obligations (what you owe them and what they owe you), their incident response team contact, and any special procedures for revoking their access. This information needs to be findable in under five minutes during an incident.

   confluencenotionpagerduty
3. 3

   Test supplier coordination in tabletop exercises

   At least annually, include supplier notification and coordination as a scenario in a tabletop exercise. Walk through the steps: who calls the vendor, what do you tell them, how do you coordinate the forensic investigation. Identify gaps in contact information, notification procedures, or contractual obligations before a real incident reveals them.

Evidence required