When a Vendor Has a Cyber Incident, What Happens to Your Business?

Seth Schwind, Account Executive

Key Takeaways

• A cyberattack against a vendor can disrupt your business even when attackers never touch your company’s systems. 
• Business leaders need to know which outside providers support critical operations and what could happen if those services become unavailable. 
• Vendor security reviews, clear communication expectations, and contingency plans can help organizations prepare for disruptions beyond their control.

Your Business Relies on Companies You Don’t Control

Payment processing, payroll, customer records, and everyday business applications often depend on outside providers. 

Employees may use these services throughout the day without giving much thought to the companies that operate them. When a provider experiences a cyberattack, the disruption can reach businesses that had no involvement in the incident. 

Your IT team may have limited information about the incident, while employees and customers expect answers about when services will return. 

Your company’s cybersecurity controls may be working exactly as intended. That doesn’t mean your business can continue operating normally. 

Companies depend on outside vendors for essential services. Understanding the third-party cyber risk associated with those relationships is an important part of protecting business operations.

When Your Vendor Has a Problem, So Do you

Most businesses evaluate vendors based on a familiar set of criteria: price, capabilities, service quality, and reliability. Cybersecurity may come up during the evaluation, but how much attention does it really receive? 

If ransomware forces a software provider to shut down its systems, employees may lose access to applications they use every day. 

A cyberattack against a payment processor could leave customers unable to complete purchases, even when the company’s website remains available. 

A breach at a service provider raises a different set of concerns. Leadership may need to determine whether attackers accessed customer information and whether the incident triggers notification requirements. 

These incidents can cost your business sales, disrupt operations, and pull employees away from their regular responsibilities. Your team may spend days managing the consequences of a security incident involving systems it doesn’t control. 

Which Vendors Could Disrupt Your Business?

You probably work with dozens of vendors, perhaps hundreds. Some provide services your employees rarely think about. Others support functions your company can’t operate without. 

Which vendors would cause the biggest disruption if they couldn’t deliver their services tomorrow? 

For each critical vendor, consider how long your company could operate without its services and whether you have an alternative if something goes wrong. 

A short outage may cause little disruption, but losing access to an essential service for several days could create serious problems. Consider whether employees could continue working or whether another provider could take over. 

A relatively inexpensive service could support an important part of your business. A vendor with a strong reputation could still experience an incident that interrupts your operations. 

Questions Worth Asking Before You Sign a Contract

Before signing an agreement with a critical vendor, make sure your team understands how the provider handles security incidents and service disruptions.  

1. What happens if your systems go down? 

Ask how the provider handles service disruptions, what recovery commitments it offers, and how it plans to restore operations. 

2. How quickly will you tell us about a security incident? 

Find out when the vendor must notify your company, whom it will contact, and what details it will share. Make sure your contract reflects your expectations. 

3. What business, employee, or customer information do you store, process, or access? 

Understand what data the vendor stores, processes, or can access. Ask whether it shares that information with subcontractors. 

4. How do you evaluate your own cybersecurity? 

Depending on the services involved, you may want to review independent security assessments, audit reports, or other evidence of the vendor’s security practices. 

5. What alternatives would we have while your service is unavailable? 

Some services offer alternatives. Others don’t. Your leadership team should understand the difference before an outage occurs. 

Your team can use the answers to determine whether the vendor meets your security requirements and what additional protections the contract should include. 

Don’t Wait For a Vendor Incident to Test Your Response

Most companies understand the need for an incident response plan. But those plans often focus on attacks against their own systems. 

What happens when a critical vendor calls to report a breach? 

Your team needs to know who will coordinate with the vendor, assess the potential impact on company information, and determine whether employees should continue using the service. Leadership also needs a plan for communicating with customers if the disruption continues. 

Your organization may have limited information at first. The vendor controls the affected environment and may need time to investigate. 

Leadership teams should discuss these scenarios before an actual incident puts them under pressure. 

A tabletop exercise can help determine whether your incident response plan accounts for vendor-related disruptions. Your team might discover that no one has responsibility for contacting the vendor or that the business has no practical alternative if a critical service goes offline. Addressing those issues now could prevent confusion during an actual incident. 

Vendor Risk Doesn’t End When You Sign an Agreement

A vendor that meets your requirements today may introduce new risks as its business changes. 

Perhaps it expands into new services, adds subcontractors, or requests access to additional company information. Your organization might also begin using the provider for functions that weren’t part of the original agreement. 

For vendors that support critical operations or handle sensitive information, establish a regular review process. Reassess their security practices when services change, access requirements expand, or new subcontractors become involved. 

Keep contractual requirements and incident response contacts current. If a vendor takes on a more important role in your business, revisit the safeguards and contingency plans associated with that relationship. 

Your Vendor Risk Is Part of Your Business Risk

A vendor’s security incident shouldn’t be the first time your leadership team discovers how much your business depends on that provider. 

Review your critical vendors, confirm who will handle communications during an incident, and determine how your business would continue operating if an essential service became unavailable. 

How CISO Global Can Help

CISO Global works with organizations to identify security risks, evaluate existing controls, and prioritize areas that need attention. Our Risk and Gap Assessments can help businesses better understand vulnerabilities and exposures, including risks associated with third-party relationships. 

We also offer Tabletop Exercises that give leadership and response teams an opportunity to practice handling disruptions before they occur. 

To learn more about assessing third-party risks or testing your organization’s response to a vendor incident, contact CISO Global.