Has your organization established formal incident response communication protocols with suppliers that define rules for reporting incidents, recovery activities, and status updates?

This question assesses whether your organization has clear procedures for communicating with suppliers during security incidents, ensuring timely information sharing and coordinated response efforts. Effective supplier communication protocols help minimize incident impact by establishing when and how suppliers should report incidents that may affect your organization, and how your organization communicates incidents that may impact suppliers. Evidence could include a documented Supplier Incident Communication Plan, communication templates for different incident types, contact matrices for key supplier security personnel, or sections in supplier contracts that specify incident reporting requirements and timeframes.