Other organisations hold much of a company’s security in their hands: managed providers, cloud platforms, software vendors, clinical systems, contractors, open-source maintainers, and AI providers. This pillar asks what those parties actually do when trouble starts.
Replacing the sentence that ends the conversation
The phrase our vendor handles that often ends the inquiry too soon. The vendor handles a defined set of events, sees a defined set of data, and can take only the actions the contract and customer permit.
An event travels from telemetry the vendor receives, through their detection and named escalation, to the actions they may take and the approvals those require.
The questions that replace it
These questions are deliberately operational. A questionnaire response cannot answer most of them.
- What do they receive?
-
Which log sources, endpoints, identities, and networks are actually in scope, and which parts of the estate send them nothing.
- What do they watch for?
-
The specific detections in place, rather than a category name like twenty-four seven monitoring.
- Who is called?
-
Named roles on both sides, with an out-of-hours path that has been dialled at least once.
- What may they do?
-
Whether they can isolate a host, disable an account, or block traffic without waiting, and what requires your approval.
- What is the response commitment?
-
Contracted times, and the observed times from the last several events.
- What if the vendor is compromised?
-
The most under-examined question. Their access to your estate is a blast radius you own.
What a vendor certificate leaves out
A vendor’s certification report describes their control environment at a point in time against their own scope definition. It is evidence about their program, not about your configuration of their product, which is where a large share of incidents originate.
Shared-responsibility boundaries therefore need direct testing. Published incident reports support that view, but the claim should keep being checked against new cases.
What would prove us wrong?
The pillar assumes tested vendor workflows predict outcomes better than vendor attestations.
-
Incident data showing that vendor certification status correlates with client outcomes as strongly as rehearsed escalation does.
-
Evidence that joint exercises are so costly or disruptive that they are only feasible for the largest clients, making the recommendation impractical rather than wrong.
-
Findings that most third-party loss originates in software supply chain compromise, where escalation testing changes little.