Purpose: This drill is designed for small organisations without a dedicated cyber team.
Immediate actions
- Request a written incident summary.
- Identify what data, systems or accounts are connected to the supplier.
- Ask whether your data or credentials may be affected.
- Review supplier access to your systems.
- Record the timeline and decisions.
- Ask for next update times and recovery expectations.
Do not
- Do not delete evidence before it is captured.
- Do not ignore it because nothing appears to have happened.
- Do not reuse passwords.
- Do not delay reporting because it feels embarrassing.
Escalate if
- Money, customer data, staff data or business-critical services may be affected.
- You suspect criminal fraud or unauthorised access.
- You are unsure what has been exposed.
After-action review
- Was reporting simple?
- Was MFA enabled?
- Were roles clear?
- What control would reduce the chance of this happening again?
Note: Practical guidance only. Seek specialist support where personal data, money loss or criminal activity may be involved.