A vendor sends a brief incident notice. It says the investigation is continuing and promises another update. Your organization still has to decide whether access should change, whether operations can continue, and who needs the information.
Turn the vendor notice into specific customer decisions
The supplier's investigation and the customer's responsibilities need connected facts.
RDA treats that notice as the beginning of a coordinated review. The vendor owns its investigation, while your organization remains responsible for decisions about its systems, information, and obligations.
Establish whether you are affected
Ask which product, environment, dates, and customer accounts are involved. Request a clear distinction between confirmed findings, potential exposure, and issues still under investigation. Establish an incident contact and the next update time.
Ask about access paths and actions
Determine whether user credentials, administrative access, integrations, API connections, or recovery details may be affected. Ask what the vendor has already revoked or changed and what the customer must do. Coordinate changes that could interrupt a business process. Review the connected User Credentials responsibilities.
Identify the information involved
Request the types of information, affected customer environment, and relevant time period. Preserve notices and supporting records. The organization needs these facts to assess privacy, contractual, insurance, and regulatory responsibilities with its responsible advisers. Use the incident-response arrangement to keep those decisions coordinated.
The FTC's breach response guide discusses coordinated response, evidence preservation, fixing vulnerabilities, and communication. Those principles can inform the customer's response without replacing the vendor's investigation or the organization's own assessment. FTC breach response guidance
Coordinate continuity and the return to service
Ask which services remain available, what restrictions are recommended, and what evidence supports the proposed return to normal use. Define who can approve a workaround or reconnection. Keep the application owner involved so a security change does not silently break an essential workflow.
Keep follow-up work assigned
Track unanswered questions, vendor commitments, access changes, and customer decisions in the work record. Review whether the event changes the vendor relationship and responsibilities, contract requirements, or monitoring needs. Notification deadlines depend on the applicable facts and requirements; do not rely on a generic timetable from a blog article.
RDA can help coordinate the technical review, application owners, and providers while management and the responsible advisers make the organizational decisions. The goal is a documented response based on the information the incident actually presents.