Does your organization adhere to contractually defined rules and protocols for incident information sharing with suppliers?

Adherence to agreed incident-sharing terms is at issue: whether you follow the contractually defined rules and protocols for sharing incident information with your suppliers. These requirements typically include timeframes for notification, types of incidents that must be reported, communication channels, and the level of detail required when sharing incident information.

Evidence could include documented incident response procedures that reference supplier contracts, communication logs showing adherence to contractual notification requirements during actual incidents, or contract excerpts highlighting the incident information sharing protocols that your organization follows.