Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

If…, then how…

If a supplier tells us they've had a breach, then how do we respond?

5 decision pointsThe pack behind this answer: Third-Party Security Risk Management

Add to board memo

The short answer

Recommendation
Treat the supplier's notice as the start of your own incident. Get the facts the contract entitles you to, work out whether your data, services or systems are touched, then reassess the supplier.
Reasoning
The time you learned of the breach matters, because your own duties to regulators and customers may run from then. Judge exposure by what the supplier can reach, not what it is meant to use. An incident at a supplier is also handled under your incident response plan (TP-10), and a breach triggers a reassessment because the tier may change (TP-09). Where the breach caused you material harm or shows a High gap, the business owner decides whether the supplier stays.
Considerations
  • Notice within 24 hours, updates every 24 hours and a cause report within 10 working days of closure are the clause library's defaults. Your contracts set the real ones.
  • The supplier's breach may be your breach in law, for example where it processes personal data for you. An internal exception can never waive a legal or regulatory obligation (EX-02), so take legal advice early.
  • Cutting a supplier's access may stop the service. The pack does not set this step: decide it with the incident lead and the service owner under your own plan.
  • Exiting a Tier 1 supplier is decided by the board, or a board risk committee it has delegated to; the management board in a two-tier structure; executive management where there is no board.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartA supplier tells us it has had a breachStepGet the facts the notice should containDecisionCould our data, services or systems be affected?StepOpen an incident under your own response planDecisionDoes the supplier have a route into our systems?StepRestrict that route until you know it is safeStepUse the cooperation clause: evidence, logs and helpDecisionCould we have to notify regulators, customers or people?StepTake legal advice now, and involve the DPO for personal dataDecisionDid the supplier tell us within the contract's time?StepRecord the late notice as a contract breachStepStart a triggered reassessment of the supplierDecisionDid it cause us material harm, or show a High gap?OutcomeThe business owner decides: conditions, escalate or exitOutcomeClose the incident and update the supplier's record

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 15 steps.

  1. Start

    A supplier tells us it has had a breach

    The notice may come from the supplier's security contact, its account manager, or a public statement. However it arrives, the time you learned of it matters: your own duties to regulators and customers may run from then. Write down when and how you heard.

    In the pack

  2. Step

    Get the facts the notice should contain

    The pack's incident clause asks for what happened and when, the data, systems and services affected, the likely consequences, the measures taken, and a named contact. It also asks for updates at least every 24 hours until closure. Ask for anything missing, in writing.

    In the pack

  3. Decision

    Could our data, services or systems be affected?

    Judge by what the supplier can reach, not what it is meant to use. A support provider with administrator access to your customer database holds that data for this purpose. Your supplier register should show its data and access. If the supplier cannot yet say, answer not known.

    In the pack

  4. Step

    Open an incident under your own response plan

    An incident at a supplier is also handled under your incident response plan. Critical suppliers should already be in it, with named contacts and notification duties. The pack does not set the response steps; your incident response plan does.

    In the pack

  5. Decision

    Does the supplier have a route into our systems?

    Count accounts, remote support tools, network links and integrations. A portal your staff use, with no route back into your systems, is not access. If you are unsure what the supplier can reach, answer not known.

    In the pack

  6. Step

    Restrict that route until you know it is safe

    Decide with the incident lead whether to suspend the supplier's accounts, tools, links or integrations, or to watch them closely. The pack does not set this step; your incident response plan and the service's owner do, because cutting access may stop the service.

  7. Step

    Use the cooperation clause: evidence, logs and help

    Where the contract carries it, the supplier must take part in your response, preserve and hand over logs and other evidence, and support your notifications. The pack's fallback makes this free for incidents that start at the supplier. Ask for its written cause report at closure.

    In the pack

  8. Decision

    Could we have to notify regulators, customers or people?

    The supplier's breach may be your breach in law, for example where it processes personal data for you. The clause library notes that GDPR gives a controller 72 hours to notify the authority, which is why supplier notice matters. If you are not sure, answer not known.

    In the pack

    See also

  9. Decision

    Did the supplier tell us within the contract's time?

    The pack's default is notice within 24 hours of the supplier becoming aware of an actual or suspected incident. Compare the date the supplier knew with the date you heard. If it will not say when it knew, answer not known.

    In the pack

  10. Step

    Record the late notice as a contract breach

    For a supplier, not meeting the security clauses of its contract is a breach of that contract, handled under its terms. Record it for the reassessment. If the contract has no notification clause, that missing clause is itself a gap.

    In the pack

  11. Step

    Start a triggered reassessment of the supplier

    A breach at a supplier triggers a reassessment starting at tiering, because the tier may change. The pack's default is to start within 10 working days of learning of it. The audit clause allows an audit on 2 working days' notice after an incident, and a certificate is no substitute for an audit then.

    In the pack

    See also

  12. Decision

    Did it cause us material harm, or show a High gap?

    A High gap is one that could directly cause a significant incident or data loss at this supplier. The breach itself may be the evidence. Material harm to you is also a ground for termination in the pack's clause. If the reassessment is not finished, answer not known.

    In the pack

  13. Outcome

    The business owner decides: conditions, escalate or exit

    The reassessment ends in a signed decision. Fixes with deadlines become conditions; a residual risk outside appetite goes into the risk register; Reject is the pack's decision for a supplier that will not fix a High gap. The termination clause lets you leave without penalty when an incident at the supplier causes material harm. In the pack, exiting a Tier 1 supplier is decided by the board, or a board risk committee it has delegated this to; the management board in a two-tier structure; executive management where there is no board.

    In the pack

    See also

  14. Outcome

    Close the incident and update the supplier's record

    Close your incident once the supplier's cause report is in and your own notifications are settled. Record the breach, the reassessment and its decision in your supplier register, and check that the supplier's contacts in your plans still work.

    In the pack

Practical checklist

  1. Write down when and how you learned of the breach.
  2. Ask in writing for what happened and when, what is affected, the likely consequences, the measures taken and a named contact.
  3. Check what data, services and systems the supplier can reach, using your supplier register. If it cannot yet say, treat them as affected.
  4. Open an incident under your incident response plan, and decide whether to restrict the supplier's accounts, tools, links or integrations.
  5. Use the cooperation clause to get logs, evidence and help with your notifications.
  6. Take legal advice on your notification duties, and involve your data protection officer where personal data is concerned.
  7. Compare when the supplier knew with when it told you, and treat a late notice as a breach of contract.
  8. Start a triggered reassessment, by default within 10 working days of learning of the breach, and take the result to the business owner.

Evidence to have ready

  • When and how you learned of the breach, and the supplier's notice and updates.
  • Your incident record, including any decision to restrict the supplier's access and who made it.
  • Each notification decision, the legal advice behind it and when it was made.
  • The supplier's written cause report, and the logs or other evidence it provided.
  • The triggered reassessment, the business owner's signed decision and the updated supplier register entry.

Assumptions

  • Notification and cooperation times shown are the defaults in the CISO Times supplier clause library. Your contracts set the real ones.
  • How you contain and investigate the incident belongs to your incident response plan. This flow covers the supplier side.

Not covered here