Third-Party Breach Response Checklist
A supplier or SaaS platform says it was breached. Work through 31 steps — verify the notice, cut or restrict the vendor's access, hunt in your own logs, get facts in writing, meet your own notification duties and decide whether to keep the vendor.
Template & sample only — a structured starting point with sample content, not legal, audit, certification or investment advice.Customise it with your own details for free; exporting the generated document is part of Pro.
A supplier, SaaS platform or managed service provider has been breached and your data or access may be exposed. Work through intake, cutting or restricting the vendor's access, hunting in your own environment, getting facts from the vendor, meeting your own notification obligations and closing out. The sample shows a fictional freight company whose payroll provider was breached.
Your context
What the vendor told us
1. Intake and triage
Treat the vendor's notice as the start of your own incident, not as their problem.
Log when and how you learned of the vendor breach (their notice, a news report, a customer) and open an incident with an ownermaterial
Verify the notice is genuine through a known contact before acting on any links or attachments in it
Pull what the vendor holds and can reach: data categories and volumes, systems, integrations and accountsmaterial
Pull the contract and data processing agreement: breach notice period, cooperation and audit rights, liability, insurance
Assign a severity using your master plan, based on data sensitivity and the access the vendor has into your environment
2. Cut or restrict the vendor's access
Assume anything the vendor could reach, the attacker could reach. Rotate first, ask questions in parallel.
List every integration with the vendor: SSO or federation trust, OAuth apps, API keys in both directions, VPN or network paths, data feeds, installed agents, vendor staff accountsmaterial
Rotate every shared secret: API keys and tokens you issued to the vendor, keys they issued you, SFTP credentials, service-account passwordsmaterial
Review OAuth grants and federation trust for the vendor's apps; reduce scopes or revoke where not needed
Restrict or close network paths (VPN, allow-listed IP ranges, site-to-site tunnels) until the vendor confirms containment
Disable or put under review any vendor staff accounts in your systems
Decide whether to suspend the integration entirely, weighing business impact against exposure, and record who made the callmaterial
Vendor integration register
One row per connection between you and the vendor, with what you did about it.
3. Hunt in your own environment
Review your logs for the vendor's IPs, accounts and API keys across the exposure window, plus a margin either sidematerial
Load the vendor's indicators of compromise into your detection tools and search back
Check inbound data feeds and files from the vendor for tampering or malicious content
If the vendor ships software or agents into your estate, check versions, signatures and update channels for tampering
Warn staff and, if relevant, customers to expect phishing that uses the vendor's name or the stolen data
4. Get facts from the vendor
Send a structured list of questions in writing and agree one named contact on each sidematerial
Get the vendor's timeline: when the intrusion started, when they became aware, when it was contained
Confirm which of your records and data fields were accessed or exfiltrated, ideally as a list you can matchmaterial
Ask for evidence of containment and eradication: forensic summary, attestation from their investigator, remediation list
Agree an update cadence until close (for example daily at a fixed time)
5. Your own obligations
Determine your role for the affected data — controller, processor or neither — and therefore whose clock is runningGDPR Art. 33material
Calculate and meet your own regulator and individual notification deadlinesmaterial
Notify your own customers or partners where your contracts require it
Notify your cyber insurer — third-party breaches are often covered differently from your own
If listed in the US, include the third-party incident in your materiality assessment — the disclosure rule covers incidents on third-party systems you useSEC Form 8-K Item 1.05
6. Close-out and supplier management
Restore the integration only after the vendor's containment evidence is reviewed and new credentials are in place
Re-assess the vendor's risk rating and decide: continue, continue with conditions, or exitmaterial
Harden the contract at renewal: shorter notice period, cooperation duties, audit rights, cost recovery
Update the vendor inventory and integration register so the next intake takes minutes
Hold a post-incident review covering how you learned of the breach, how fast you cut access, and what your inventory missed
What this template gives you
- Six phases: intake and triage; cut or restrict access; hunt in your own environment; get facts from the vendor; your own obligations; close-out and supplier management.
- An integration register lists every connection to the vendor — SSO, OAuth apps, API keys in both directions, VPN, data feeds, agents, vendor staff accounts — and what you did about each.
- If the vendor is your processor, your own regulator clock can start when the vendor tells you. The checklist makes you decide your role early.
- Sample content shows a fictional freight company whose payroll provider lost employee bank details and tax IDs.
Frequently asked questions
A vendor told us they were breached. What do we do first?
Log when you found out, verify the notice through a contact you already hold, and pull what the vendor holds and can reach. Then rotate every shared credential and review every integration — in parallel with asking the vendor questions, not after they answer.
Whose job is it to notify regulators when a vendor is breached?
It depends on the roles. Where the vendor processes personal data on your behalf, you are usually the controller and the regulator notice is yours; the vendor must tell you without undue delay. Where you act as a processor for your own customers, you owe them notice under your contracts. Confirm with counsel.
Should we switch off the vendor integration?
Restrict or suspend it if the vendor held credentials, network access or software running in your estate and cannot yet show containment. Weigh business impact, agree a time limit and a manual fallback, and record who made the decision.
Is this a finished document I can rely on?
No. Every tool in this suite is a template with sample content. It gives you a structured, editable starting point and generates a document from your own answers, but it is not legal, audit, certification, investment or professional advice. Review and adapt the output, and have it checked by the appropriate specialist before you rely on it.
Who can use it?
Anyone. Using it and customising it with your own details is free, and your work is saved in your own browser. Exporting the generated document (Word, PDF, Markdown, CSV) is part of any PlayCISO paid plan.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.