Supplier or third-party breach: incident response playbook

First 15 minutes

1. Find out what data and access the supplier has.
2. Ask the supplier for details in writing: what, when, whose data, what they have done.
3. Rotate credentials, API keys and integrations shared with the supplier.
4. Record it in the incident log even if you are not yet affected.

Set the severity and download a first-response checklist

What the full playbook covers

• Contain (1 steps)
• Eradicate (1)
• Recover (1)
• Who to notify
• Evidence to keep

The full playbook is in the Incident Response & Business Continuity Kit with 8 more, the IR plan, a BCP/DR plan and 6 tabletop exercises.

Other playbooks

• Phishing and business email compromise
• Ransomware
• Lost or stolen device
• Data sent to the wrong person or exposed
• Compromised account or cloud admin access
• Malware on a device
• Major outage or denial of service
• AI tool data leak or misuse