Your vendor was breached. Your customers are asking you.

What it is

Five printed sheets that let somebody inside your company facilitate a 3-hour third-party breach exercise for 6 to 12 people. A payroll and human resources platform you use has disclosed a breach. You found out from a client forwarding a news article, your account manager is not answering, and the platform holds names, addresses, dates of birth, social insurance numbers and banking details for everybody who works for you.

It is the hardest of the three to run, and that is the point. In your own incident you can look at something. Here there is nothing to look at, and every hour the room spends trying to establish what happened is an hour not spent deciding what to say. The room makes four decisions in 3 hours and produces none of the facts behind any of them. The skill being tested is acting on somebody else's timetable, which is the skill nobody practises.

The platform, the data types and the timeline are fiction and are meant to be swapped for yours. Sheet 2 says which parts of the shape to keep when you do.

What is inside

The five sheets of the third-party breach scenario pack, and what is on each

Sheet	What it is	What is on it
1	Cover, and before you run it	Why this is the hardest of the three to run, the one page you cannot write, who reads which sheet and when, and the one rule.
2	The brief, and the chain of obligation	The brief you read aloud at fifteen minutes in, then the facilitator’s scoring sheet: four relationships, each running on a different clock, and where each one breaks in the room. Held back, not handed out.
3	Injects one and two	The vendor has said something and it says nothing, then cut the connection and payroll runs on Friday. Each card carries what to push for and what you are listening for, plus a note on how to play the vendor without ending the exercise early.
4	Injects three and four, and the reserve	Two audiences and one of them works here, then the vendor hands you a finished assessment of your own incident. Plus one inject held off the clock, with a note on when not to use it.
5	The capture sheet, and your contracts	Four rows for the scribe, including a column for elapsed time that cannot be reconstructed afterwards. Then four things to check in your own contracts this month, which is the take-away work the exercise generates.

The facilitator marks the room against a chain of four obligations rather than against whether anybody managed to get the vendor on the phone.

The four links in the chain of obligation, and where each one breaks in the room

Link	What runs along it, and where it breaks
Vendor to you	Notice, usually inside a contractual window that starts when they determine a breach occurred. That is a date they control and you cannot check.
You to your staff	Nothing contractual, and the decision that matters most on the day. Everybody waits for facts, the staff channel fills the gap, and by Friday the company is answering a rumour.
You to your clients	Whatever your contracts say, which somebody has to read today. Most rooms do not know which agreements carry a supplier-incident clause or how many hours it allows.
You to a regulator	An assessment about information you never held yourself. The room assumes the vendor makes it. If it is not sure whether accountability moved when the processing did, that uncertainty is the finding.

The four decisions the room is pushed to make, and what each one is testing

The decision	What it puts in front of the room
1. The one question	The room will want to ask the vendor ten things. Which single answer changes what you do next, who owns putting it in writing today, and what you do while nothing comes back.
2. Cut or keep	Revoking the platform’s access means running payroll manually for the first time in four years, and the vendor warns it may slow their answers about your own data. Who authorises it, and is that warning a constraint or leverage.
3. Clients and staff	A client wants a written statement by end of day and an employee has asked in the staff channel whether their social insurance number is out there. Which happens first, and who signs the statement.
4. Whose assessment	The vendor confirms what was taken, on their forensics, and offers to notify your people themselves. Whether their finding is your assessment, and who decides that.

When to use it, and when it is the wrong thing to reach for

Use it if the data you would least like to lose sits on somebody else's platform, which for most companies of this size is payroll, human resources, the document store or the customer database. It is also the right exercise if your client contracts oblige you to report incidents at your own suppliers and nobody has read those clauses recently. Sheet 5 turns that into four questions to answer in the month afterwards.

It is the wrong thing to reach for if you want a room that can investigate its way to an answer. Nothing here is knowable from inside your company. If you want the technical response tested, use the ransomware pack. If the exposure is money rather than data, use the business email compromise pack.

It does not produce third-party attestation, and page one of the pack says so. Everything the session generates is yours to keep. The attestation is not, and in a supplier breach it is the only document in the file that is about your own conduct rather than your vendor's.

Why it is not on this page in full

Because the chain-of-obligation table on sheet 2 is the facilitator's scoring sheet and carries the instruction not to hand it out, and both inject sheets are read by one person and nobody else. The table names in advance where each of the four relationships will break. Publishing it would mean the first person in your company to find this page has read where the room is expected to fail, and the exercise stops finding anything.

So the pack goes to one person by email, and the rest of the session is theirs to run. One email address, and the file is on the next page rather than in your inbox.