Incident Response KitSupplier or third-party breach: incident response playbook
Use it when: A supplier tells you they had an incident, or you learn it from the news.
First 15 minutes
- Find out what data and access the supplier has.
- Ask the supplier for details in writing: what, when, whose data, what they have done.
- Rotate credentials, API keys and integrations shared with the supplier.
- Record it in the incident log even if you are not yet affected.
Set the severity and download a first-response checklist
What the full playbook covers
- Contain (1 steps)
- Eradicate (1)
- Recover (1)
- Who to notify
- Evidence to keep
The full playbook is in the Incident Response & Business Continuity Kit with 11 more, the IR plan, a BCP/DR plan and 6 tabletop exercises.
Other playbooks
- Phishing and business email compromise
- Ransomware
- Lost or stolen device
- Data sent to the wrong person or exposed
- Compromised account or cloud admin access
- Malware on a device
- Major outage or denial of service
- Data leaked to an AI tool
- Rogue or misbehaving AI agent
- Prompt injection against an AI assistant or agent
- Deepfake or voice-clone payment fraud