Supplier notification affects your response clock
Your obligations may start when your supplier tells you, and you do not control when that is.
If their contract allows seventy-two hours to notify you and yours requires you to report within seventy-two hours of awareness, the arithmetic does not work. Notification timescales in supplier contracts are a security control with a regulatory consequence, and they are usually negotiated by people thinking about commercial risk.
More on Third-party risk
- Security clauses need operational follow-throughWire the clause to something
- Shared responsibility should name the seamName the join
- Privileged vendors deserve privileged controlsSame review, very different reach
- Exit plans are security controlsThe pipe that goes back
- CI/CD secretsIt has to reach everything
- SBOMsThe list, and the verdict