Managing Incidents Involving Third Parties

A security incident originating with a vendor poses different challenges from an internal one: the affected organization has no direct control over the compromised systems, depends on the information the vendor chooses to share, and often learns of the incident late if the contract doesn't require immediate notification. Managing these incidents requires predefined communication processes with each critical vendor, clear roles for who leads containment when the compromised system isn't your own, and a contingency plan that makes it possible to operate without that vendor while the incident is resolved. Experience shows that the best-prepared organizations are those that already simulated this scenario before it happened, for example through a tabletop exercise with a critical vendor, instead of improvising communication channels and responsibilities in the middle of the real crisis, when every hour of indecision widens the impact.