Has your organization established formal rules and protocols for information sharing and reporting with suppliers?

This question assesses whether your organization has documented procedures that govern how security information, incidents, vulnerabilities, and updates are shared between your organization and suppliers. These protocols should define what information can be shared, with whom, through which channels, and under what circumstances. Evidence could include a Supplier Information Sharing Policy document, communication protocols outlined in supplier contracts, documented incident reporting procedures for suppliers, or templates for security notifications that flow between your organization and suppliers.