Does your organization adhere to the incident information sharing rules and protocols defined in supplier contracts?

This question assesses whether your organization follows the contractually defined procedures for sharing security incident information with suppliers and vice versa. These protocols typically specify what types of incidents must be reported, timeframes for reporting, communication channels, and confidentiality requirements. Evidence could include documented incident response procedures that reference supplier notification requirements, communication templates aligned with contractual obligations, incident logs showing timely supplier notifications, or meeting minutes from incident reviews that demonstrate adherence to contractual information sharing requirements.