Supplier Post Breach Report Request Form

As a customer organization, we have been informed of a security incident affecting your systems or services, which may impact our operations or data. Please provide comprehensive responses to the questions below to help us assess the situation and determine the steps needed to restore full access to your services.

Respondent Information

Name

Title

Company Name

Submission Date

The Incident & Its Impact

What occurred and when? (Include the nature of the breach, affected systems, date and time of detection, timeline of the breach, attack vectors, and scope of data affected)

Has the incident been fully contained and eradicated? (Include steps taken, evidence of threat removal, and status if not fully resolved)

Have you engaged your cyber insurance provider? (Include date of notification, status of claims, and coverage details)

Have you engaged an incident response firm? (Include firm name, date of engagement, scope, and key findings)

Have you engaged a digital forensics firm to obtain a report? (Include firm name, engagement date, report timeline, preliminary findings, and sharing plans)

What measures have been taken to prevent recurrence? (Include technical controls, policy updates, training, monitoring, and planned assessments)

Regulatory and Law Enforcement Reporting

Have you reported the incident to the Information Commissioner’s Office (ICO)? (Include date, nature of notification, ICO feedback, and reason if not reported)

Have you reported the incident to law enforcement? (Include agency, date, report reference, nature of incident, and ongoing engagement)

Have you engaged with the National Cyber Security Centre (NCSC)? (Include date, reporting method, guidance received, and reason if not engaged)

Incident Reporting to Customers

How were you made aware of the incident? (Include method of detection, tools used, and time elapsed until detection)

When and how was this reported to our organization? (Include date, time, method, content, and compliance with deadlines)

Who within your organization is responsible for coordinating incident communications? (Include name, role, contact info, and update frequency)

Restoring Services

Provide evidence of remediation (Include documentation or third-party validation of secure systems)

Confirm account and access control measures (Include details on securing compromised accounts and strengthening access controls)

Detail how system integrity was verified (Include vulnerability scans, penetration testing, or system reimaging)

Provide a data impact assessment (Include whether our data was compromised, type, volume, sensitivity, and mitigation steps)

Outline the restoration plan (Include timeline, process, and verification steps for restoring access)

Describe ongoing monitoring plans (Include monitoring for further compromise and shared telemetry or alerts)

Submission Instructions

Please submit your responses by June 9, 2025, 5:00 PM BST to security@customerorganization.com. If additional time is needed, please notify us immediately with a proposed timeline. For questions, contact Jane Doe, Chief Information Security Officer, at jane.doe@customerorganization.com.