Does your organization adhere to the incident information sharing rules and protocols defined in supplier contracts?
Explanation
Contractual incident sharing is what's under review, covering whether you adhere to the information-sharing rules and protocols for security incidents set out in your supplier contracts. These protocols typically specify what types of incidents must be reported, timeframes for reporting, communication channels, and confidentiality requirements.
Evidence could include documented incident response procedures that reference supplier notification requirements, communication templates aligned with contractual obligations, incident logs showing timely supplier notifications, or meeting minutes from incident reviews that demonstrate adherence to contractual information sharing requirements.
Implementation Example
Follow the rules and protocols defined in contracts for incident information sharing between the organization and its suppliers
ID: RS.CO-03.337
Context
- Function
- RS: RESPOND
- Category
- RS.CO: Incident Response Reporting and Communication
- Sub-Category
- Information is shared with designated internal and external stakeholders
Related questions
- Do personnel understand their specific roles, responsibilities, and the order of operations during a security incident response?
- Does your organization have documented breach notification procedures that include a process for notifying affected customers in the event of a data breach?
- Does your organization have documented procedures for notifying business partners and customers of security incidents in accordance with contractual obligations?
- Does your organization have documented procedures for notifying law enforcement and regulatory bodies of security incidents that include specific notification criteria and required management approvals?
- Does your organization have documented processes for securely sharing information during incident response that align with established information sharing agreements?
- Does your organization voluntarily share information about observed threat actor tactics, techniques, and procedures (TTPs) with an Information Sharing and Analysis Center (ISAC) or similar industry group after removing sensitive data?