The Cyber Incident Started at a Vendor. Your Response Still Starts at Home

A software provider or payroll vendor may send the first alert, but your customers and employees will still turn to your organisation for answers. Waiting for the vendor’s final investigation can leave important response work undone.

Treat the notice as your incident too, with internal ownership, evidence and policy notification.

Establish what is known and unknown

Identify affected services, data, users, integrations and time periods. Preserve vendor notices and contracts, and request regular written updates through an agreed contact.

• Disable or restrict risky connections where appropriate.
• Review logs in systems under your control.
• Coordinate legal, privacy and communication advice.
• Notify relevant insurers through the required route.

Use the contract without depending on it

Indemnities and notification clauses may matter later. They do not replace immediate containment, customer care or regulatory analysis. Record your own costs and decisions from the first day.

What to remember

Outsourcing a service does not outsource the disruption. Build vendor incidents into exercises so the internal team knows who acts before complete answers arrive.

Coverage, exclusions, limits and claim requirements vary by insurer and policy. Read the customer information sheet and policy wording before you buy or renew.