1. What is actually affected at the provider?
Ask whether the incident involves office IT, development environments, production systems or customer data. An issue in an internal system does not automatically mean the customer platform is compromised. Equally, a reassurance applies only to the scope the provider has confirmed. Record the source, time and outstanding questions.
2. What does your organisation depend on?
Map applications, identities, integrations and business processes connected to the provider. Management assesses operational impact; IT traces technical connections. Include indirect dependencies, shared access accounts and options for maintaining critical operations.
3. Who decides, and who must be informed?
Name accountable contacts for IT, management, privacy and legal review where necessary. Agree a provider contact and update schedule. Document who authorises actions and when staff or customers genuinely need to be informed.
4. What is verified, and what remains uncertain?
Use a short situation record covering verified facts, assumptions, potentially affected services, agreed actions and update times. Ask providers to define the exact scope of statements. Avoid sending credentials, sensitive network diagrams or personal information through unprotected email.
5. Which next steps are proportionate?
Qualified specialists should assess whether accounts, logging, controls, backups or recovery procedures require attention. Review contractual and legal notification or reporting requirements, including any deadlines, early and for the specific situation. Do not wait for the full technical investigation to finish.
Prepare before an incident occurs
A critical-supplier inventory, emergency contacts, clear escalation paths and tested recovery processes are useful regardless of any particular incident. This guidance reflects general risk-management principles and does not replace specialist security or legal advice.
Sources & status
Publicly verified foundations
This article is an independent TM-Connect analysis. The sources and their individual verification dates document its technical foundations. Product suitability and availability are assessed for each project.
- NIST: Cybersecurity Framework 2.0checked 01 November 2026
- NIST: Incident Response Recommendations – SP 800-61 Rev. 3checked 01 November 2026