Vendor incidents: settling reporting paths and decisions before the incident

A shared situational picture needs fixed minimum information

Affected service, start, impact, data involvement, containment, next steps and expected updates should be transmitted in a structured form. Contacts and fallback channels must be tested regularly.

Internal obligations run in parallel

The organisation assesses its own reporting, information and continuity obligations regardless of whether the provider has completed its investigation. Contracts should allow interim reports and continuous updates.

• 24/7 contacts and authentication
• initial reporting deadline and update frequency
• evidence preservation and cooperation
• post-incident report and corrective actions