Does your organization include critical suppliers in incident response exercises and simulations?

Including critical suppliers in incident response exercises ensures coordinated response capabilities during security incidents that may involve or impact your supply chain. This practice helps identify communication gaps, clarify roles and responsibilities, and test the effectiveness of response procedures across organizational boundaries.

Evidence could include documentation of joint incident response exercises with suppliers, such as exercise plans, after-action reports, or meeting minutes that demonstrate supplier participation in tabletop exercises or simulations. Screenshots of collaborative incident management platforms showing supplier involvement would also serve as appropriate evidence.