Does your organization have formal agreements with third parties (e.g., ISPs, MSSPs) authorizing them to perform containment actions during security incidents?

This question assesses whether your organization has established formal relationships with trusted third parties who can act quickly to contain security incidents on your behalf. Such arrangements can be crucial during critical incidents when internal resources may be overwhelmed or when specialized expertise is required for effective containment. Evidence could include signed service level agreements (SLAs) with third parties that explicitly authorize containment actions, documented procedures for third-party incident response, or records of tabletop exercises conducted with these third parties to test containment procedures.