IG-Smart practical guides | Incident assurance Edition: 24 October 2026 | Audience: Procurement, boards, legal, DPOs, CISOs and affected service owners

Use this guide to make a better-evidenced decision. This is general information and an original working aid, not a client-specific legal opinion, certification, clinical safety authorisation or regulatory approval. Apply the relevant jurisdiction, current requirements and competent professional review to your circumstances. Examples are illustrative unless expressly attributed.

Your first three steps

  1. Use established incident escalation arrangements immediately; do not wait for this worksheet.
  2. Separate known facts, supplier assertions and unanswered questions.
  3. Record the evidence and authority behind any continued use, restriction or return to service.

What evidence should an enterprise request after a supplier cyber incident—and how should it decide whether to continue, restrict, suspend or exit the service?

Executive proposition: A supplier's statement that an incident is “contained” is not proof that customer information was unaffected, access paths are secure or the service can safely resume. Post-incident assurance requires bounded factual evidence, appropriate legal decisions, independent challenge and a documented residual-risk owner.

For: Board audit and risk committees, procurement, CISOs, Legal, DPOs, business-service owners, regulated-sector buyers and supplier risk teams. Scope: third-party cyber assurance and governance. This is not emergency digital forensics, legal privilege advice, incident-response engineering or an automatic right to demand another firm's sensitive forensic data.

Executive briefing — seven questions after a supplier incident

  1. What service, legal entity, region and subcontractor are affected?
  2. What is known, not known and only asserted about the incident?
  3. Could our data, services, patients, customers or staff be materially affected?
  4. What containment and eradication evidence supports current supplier claims?
  5. What relevant contractual, privacy, sector and regulatory decisions must we make independently?
  6. How will we decide whether to continue, restrict, suspend, substitute or terminate?
  7. Who will verify recovery and monitor renewed exposure?

A supplier response must be proportionate to the incident and the customer's actual exposure. Boards should not demand broad distribution of restricted forensic reports when a secure independent review or bounded assurance statement can supply the necessary evidence; conversely, a polished one-page supplier FAQ is insufficient to verify a consequential exposure.

If an incident is ongoing: activate the organisation's established incident, legal, clinical and supplier escalation arrangements now. This guide and an ordinary consultancy enquiry are not an emergency response channel. Do not send personal datasets, credentials or confidential forensic reports through a public contact form.

1. Distinguish the events and affected interests

A cyber event at a supplier does not necessarily mean the buyer has suffered a personal-data breach, nor does it exclude one. Determine whether the supplier is the processor for buyer-controlled personal data, an independent controller, a platform operating a business-critical service, a subprocessor or a mixed-role party. Identify actual data access, integrity changes, operational outages, identity trust and evidence preservation.

Different reporting duties can arise under UK GDPR, contracts, NHS arrangements and financial-sector or other applicable law. A controller must notify the ICO of a personal data breach unless it is unlikely to result in a risk to people's rights and freedoms; notification is without undue delay and, where feasible, within 72 hours of becoming aware. A high risk can also trigger notification to affected people without undue delay. A processor informs its controller without undue delay. Record detection, awareness and decision times separately. Do not wait for a complete forensic report where notification is due: provide available information and supplement it as permitted. Other duties can have different triggers and deadlines. [S1]

The UK Cyber Governance Code highlights board-level oversight of incident planning, response and recovery; supply-chain responsibility remains with the buyer's appropriate decision-makers even when technical containment is performed by another company. [S2]

2. The IG-Smart Supplier Incident Assurance Gate — eight stages

IG-Smart framework · 8 stagesSupplier Incident Assurance Gate
  1. P1 — BoundaryWhich contracted service and entity were exposed?
  2. P2 — Fact patternWhich events and dates are independently supported?
  3. P3 — Customer impactWhat data, availability or integrity consequences exist?
  4. P4 — ContainmentWhat access or path has been stopped, and how verified?
  5. P5 — ObligationsWhich notices, contract and sector duties apply to us?
  6. P6 — RecoveryIs the restored service trustworthy in our environment?
  7. P7 — DecisionContinue, restrict, suspend, exit or conditional use?
  8. P8 — MonitoringWhat future evidence and trigger are required?

Safeguard: Mandatory legal and safety safeguards override any aggregate supplier score.

Proposed IG-Smart assurance methodology — not a forensic accreditation or statutory checklist. Full detail follows in the text and table below.

GateCore questionDocumentary recordStop / escalate
P1 BoundaryWhich contracted service and entity were actually exposed?Supplier and service dependency mapMaterial boundary unknown
P2 Fact patternWhich events and dates are independently supported?Incident chronology and provenanceClaims cannot be corroborated
P3 Customer impactWhat data, availability or integrity consequences exist?Tenant, account, data and service analysisConsequential unknown exposure
P4 ContainmentWhat access/path has been stopped and how verified?Revocation evidence, test findingsActive compromise not excluded
P5 ObligationsWhich notices, contract and sector duties apply to us?Legal decision log, clocks and ownersTime-critical obligation unmanaged
P6 RecoveryIs the restored service trustworthy in our environment?Recovery tests, configuration and monitoringRecovery claimed without testing
P7 DecisionContinue, restrict, suspend, exit or conditional use?Options, residual risk, approving authorityAcceptance outside delegation
P8 MonitoringWhat future evidence and trigger are required?Retest, action, supplier and board timetableNo owner or future challenge

This is a proposed IG-Smart assurance methodology, not a formal forensic accreditation or statutory checklist. Mandatory legal/safety safeguards override any aggregate supplier score.

3. The incident information request: minimum viable chronology

Evidence fieldRequestCaution
DetectionWhen and how discovered?Discovery is not necessarily first compromise
Initial containmentWhat actions were taken and timestamps?A proposed action is not completed containment
Root causeKnown, provisional or unconfirmed?Do not overstate preliminary investigations
Affected componentsAccounts, environments, data and regionsConfirm exact buyer tenant/service
Actor capabilityEvidence of access, exfiltration or manipulationAbsence of logs is not proof nothing occurred
Supplier noticesWhich communications, contracts and deadlines apply?Distinguish private client notices from regulator notices
Recovery statusWhat was restored and independently validated?Service availability differs from integrity
Remaining issuesKnown gaps and compensating safeguards“No remaining risk” is rarely meaningful
Future controlActions, assurance and review dateOwnership must be contractual and operational

Request reliable summaries, security artefact references and controlled expert access as appropriate. Avoid circulating raw customer data, threat actor material, credentials or unrestricted forensic images.

4. Questions to ask before accepting the supplier's containment claim

Identity: have compromised tokens, credentials, certificates and privileged sessions been invalidated and traced? Persistence: what forensic and monitoring work supports absence of continuing attacker access? Data: how did investigators determine what was accessed, altered or exported, and what logs are missing? Architecture: are shared infrastructure and fourth-party pathways affected? Patches: has the exploited entry point been remediated and retested? Recovery: are recovered systems trustworthy and data reconciled? Monitoring: what heightened detection will remain active and for how long? Independent review: who performed it, with what competence, independence and scope?

When the buyer lacks access to sufficient evidence, record the limitation explicitly and apply appropriate risk decisions. A contractual obligation to cooperate does not mean every sensitive security document must be distributed without controls.

5. Legal, contractual and regulatory workstreams

WorkstreamDecisionAccountable function
UK GDPRIs the buyer a controller; is there an actual personal-data breach; is reporting required?Controller/Legal/DPO with incident evidence
ContractDo notification, cooperation, service credits, audit rights or termination rights apply?Legal and procurement
NHS and clinical safetyCould patient data or care delivery be affected; do NHS reporting/safety procedures apply?NHS/clinical/IG accountable team
Financial sectorAre operational resilience and applicable regulator or DORA/NIS duties engaged?Regulated firm's Legal/Resilience lead
Litigation and privilegeHow should evidence be preserved and counsel engaged?Qualified legal advisers
Cyber controlsIs renewed access safe and how is it tested?CISO/incident response and service owners
CommunicationsWhat can be said accurately to customers, workforce and stakeholders?Communications with Legal and incident lead

Time-critical action: agree a legal-notification clock based on awareness and the applicable rules. Do not delay mandatory notifications until the supplier completes a “final root cause” report. Conversely, do not claim all vendor attacks must be notified to every regulator.

6. The risk-based supplier continuation decision

Possible decisions include:

Continue under enhanced monitoring: scope and risk are sufficiently understood, critical controls verified and no legal or safety blocker remains.

Continue conditionally: impose restricted access, key rotation, additional logging, independent test, remediation milestones and termination triggers, with suitable authority.

Restrict or suspend: current exposure makes ordinary access, data exchange or critical dependency unacceptable; activate contingency arrangements proportionately.

Substitute or exit: remediation is ineffective, evidence remains fundamentally inadequate or supplier confidence is no longer defensible, subject to continuity, contractual and safety implications.

The buyer must evaluate the risks of both continued use and immediate withdrawal. Abruptly removing a clinical or critical infrastructure supplier can itself create material harm. Document continuity and transition controls rather than defaulting to an automatic termination demand.

Supplier assurance decision matrix

FactorEvidence of acceptable positionUnacceptable / unresolved sign
Incident scopeTenant/service-specific verified boundaryUnknown affected systems/recipients
Attacker accessCredible investigation and compensating measuresPrivileged persistence cannot be addressed
Data integrityTargeted reconciliation and tested restoreMaterial records may be altered
RecoveryTested relevant service performanceAvailability alone, no trust verification
Contract cooperationTimely and relevant information, documented limitsPersistent material refusal to cooperate
Regulatory dutiesNamed owner and recorded legal decisionDeadlines unmanaged
Independent challengeProportionate objective review where neededUnreviewed “all clear”
Future monitoringVerified milestones and re-entry triggersSupplier declares closed, no follow-up

7. Post-incident evidence library: twelve critical requests

  • [ ] Legal entity, incident ID and incident liaison authorised to answer.
  • [ ] Version-controlled timeline with unknowns clearly marked.
  • [ ] Exact affected buyer services, environments and contractual entities.
  • [ ] Data categories, affected data subjects and access/exfiltration evidence.
  • [ ] Privileged access, token/certificate compromise and revocation status.
  • [ ] Threat actor containment and persistence evaluation, with review scope.
  • [ ] Root-cause hypothesis and level of confidence.
  • [ ] Compensating safeguards and tested control restoration.
  • [ ] Data-integrity validation and recovery results.
  • [ ] Relevant external or independent assurance scope and exceptions.
  • [ ] Customer/regulatory notification, contractual and cooperation record.
  • [ ] Residual actions, owner, deadline, verified close-out and monitoring triggers.

8. Four illustrative cases — not actual client engagements

Managed cloud backup vendor: backups are available but encryption administration may have been compromised. Buyer requires key-custody analysis, tested restore integrity and an authorised continuation decision.

Clinical integration provider: an interface is isolated during containment, interrupting patient referrals. A clinical safety lead tests safe manual fallback and patient-impact consequences before changes to supplier access.

Financial services critical service: a fourth-party outage affects an important business service. The firm assesses recovery objectives, concentration risk, contract and relevant regulatory obligations independent of the supplier's incident closure report.

SaaS customer data exposure: the supplier says “no evidence of exfiltration” while retaining only seven days of relevant logs. Buyer records the evidential limitation, investigates its own environment and determines privacy notifications under the relevant threshold.

9. One-page board incident assurance briefing

Supplier/service: __; incident discovery/awareness dates: __; buyer consequences: __; known facts vs unresolved questions: __; containment verification: __; privacy and regulatory decisions: __; service restoration and data integrity: __; options and continuity impact: __; residual risk and evidence confidence: __; decision: continue / conditional / restrict / suspend / exit; approver: __; follow-up and stop triggers: __.

10. Frequently asked questions

Is a supplier's ISO 27001 certificate enough after an incident? No. Check relevant scope, actual incident facts, recovery evidence and open exposures.

Must a supplier release its entire forensic report? Not necessarily. Seek proportionate, verifiable evidence or controlled review satisfying the buyer's risk and legal needs.

Is “no evidence of access” conclusive? No. It describes what the investigation has or has not established within its logs, coverage and limitations. It is not proof that access did not occur. State the evidence boundary and unresolved uncertainty.

Does the UK GDPR require notification for every supplier cyber event? No. The relevant controller must assess whether a personal-data breach occurred and the applicable risk threshold.

Can a board approve high residual risk? Only within its legal and delegated authority and without overriding mandatory duties or critical safety constraints.

Can the supplier be removed immediately? Consider legal rights and continuity risk; for critical or clinical operations an unmanaged removal could cause separate harm.

11. How to operationalise without creating a second incident command

The customer should coordinate through its incident manager and the supplier's nominated lead. Maintain one shared fact timeline where lawful and appropriate, separate legal decisions and a controlled evidence register. Hold short, time-bound assurance checkpoints and keep emergency containment teams focused on technical containment rather than responding to unstructured questionnaires.

Use the companion evidence tracker to separate received documents, independently observed controls, open material facts, legal decisions and management-authorised risk acceptance. No numeric supplier score should mark an incident “resolved”.

12. Commissioning post-incident assurance

Next step: Submit a Requirement describing the supplier dependency, current facts, requested assurance and relevant deadlines—without submitting sensitive incident reports through a public form.

Sources