A supplier tells you they were breached

Somebody else had the incident and you have the exposure. The work is establishing what they held, what they could reach, and whether their access into your estate is still open, usually with far less information than you want.

Trigger. A notification from a vendor, or their name in the news before their email arrives.

The first 120 minutes1 of 5 expire

01 02 03 04 05

060 min120

01
Write down what they hold and what they can reach
by 30 min
Two different questions. Data they were given, and access they were granted: service accounts, API keys, VPN or remote access, OAuth grants, and any federation. The second is usually undocumented and is the one that matters.
02
Hunt their access in your own logs
by 60 minexpires
Sign-ins and API calls attributable to the supplier across the stated incident window, and a reasonable margin either side. Your logs are evidence about their incident and may be better than theirs.

Tell somebody

Legal and the data protection lead, early, because your obligations may not wait for their investigation
Procurement, on what the contract actually requires them to tell you and by when
Executive, if the supplier is one you cannot operate without

Drawn from

The documents these steps come from, so you can check one rather than take it on trust.

The evidence

What each source proves, and what it does not.

logon events

Collect it in one go

A read-only script that gathers most of the above in volatility order, with a hash manifest.

Triage collection

Make it yours

Replace the escalation list with real names, and the timings with what your change process actually allows. A playbook that assumes an authority you do not have will stall at the step that needed it.

Write down what they hold and what they can reach

Hunt their access in your own logs