Vendor-Breach Board Response Lab
A critical SaaS vendor that holds your data and runs part of your operations has just been breached. Now the hard part: how big is this for you, who do you have to notify and on whose clock, what do you shut off, and what do you tell the board? Sit in the response committee and make each call the way a regulator and a court would judge it — a vendor’s breach is still your event; you size your own blast radius, rotate the credentials you share and drive notification off your legal duties, not the vendor’s timeline. Each decision shows you why.
Pair this drill with the free Third-Party Breach Response Playbook & Board Brief — the document that records the calls you practise here. Educational drill, not legal advice.
The real job. More noise, a tighter clock.
A critical SaaS vendor that holds your data and runs part of your operations has just been breached. Work 10 board-room decisions — size the blast radius, pull the right contract and control levers, and make the call a court and a regulator would find defensible, then see why. You are graded on how many you get right against the clock.
What this lab is
- A free, browser-based decision drill on responding to a breach at a critical third-party / SaaS vendor that holds your data or runs part of your operations: work ~14 board-room decisions on scope, notification, controls and board messaging.
- The hard truth it drills: a breach on the vendor’s systems can still be YOUR material event, YOUR notification duty and YOUR customers’ problem — the vendor’s obligations do not discharge yours.
- You practise the real moves: size your own blast radius, assume the vendor may still be compromised, rotate shared credentials and isolate the integration, invoke the contract levers, and decide notification off YOUR legal duties — not the vendor’s timeline.
- It also covers concentration risk to the board, fourth-party (sub-processor) exposure, not blaming the vendor prematurely, and the SEC rule that third-party incidents are not carved out.
- Each decision reveals why the board-defensible answer is right, and you are graded S–D on how many you call correctly against the clock. Educational drill — not legal advice. Pair it with the free third-party breach response playbook template.
Frequently asked questions
What is the Vendor-Breach Board Response Lab?
A free, in-browser decision simulation that puts you in your company’s response committee after a critical SaaS or third-party vendor is breached and your data or operations are affected. You work through board-room decisions — how big is this for us, who do we have to notify, what do we shut off, what does the contract let us do, what do we tell the board — and each one has a single board-defensible answer, revealed after you lock in your call.
If the breach was at the vendor, are the notification duties still ours?
Usually yes. As the data controller/owner you keep your legal obligations regardless of whose systems were hit, and most privacy regimes (GDPR, US state breach laws, HIPAA and sector rules) run their notification clocks on your awareness and the data involved — not on the vendor’s preferred announcement date. Coordinate with the vendor, but your deadlines are yours.
Does the SEC 8-K rule apply to a vendor-hosted incident?
Third-party incidents are not carved out of the SEC cybersecurity disclosure rules. If the impact on your company is material you must assess and, if required, disclose on Form 8-K Item 1.05 to the extent of your knowledge — relying on the vendor for facts that may be incomplete at the time of filing.
Is this legal advice?
No. The lab is an educational drill and the regulatory references (SEC Item 1.05, GDPR, US state breach-notification laws, HIPAA) are summarised for orientation and can change. Always confirm the current requirements and apply them to your specific facts and contracts with qualified counsel.