The 72-Hour Clock and the Unpatched Vendor
A regional hospital network (14 facilities, 9,000 staff) detects ransomware on a billing server at 22:40 Friday. The encryption has begun spreading to a shared drive holding referral records. The CISO confirms the malware entered through a third-party telehealth vendor's remote-access tool that the hospital never formally approved. Patient care systems are unaffected so far, but 3,000 records appear exfiltrated. The vendor contract has no breach-notification clause. The board chair wants to keep it quiet until 'we understand it.' The state breach law requires notice within 30 days; a sector regulator expects notification within 72 hours for incidents affecting care continuity; the FBI has offered to help but asks the hospital to delay public disclosure. The incident commander must decide notification sequencing by Monday morning.
1. How should the incident commander sequence internal, regulatory, law-enforcement, and affected-individual notifications, and why?
Read the worked answer
Sequence by legal clock and harm, not by reputation anxiety.
- Internal escalation (immediate): Activate the incident response plan, brief the board's designated committee, and document decisions with timestamps - regulators later ask when you knew.
- Containment before notification content: Isolate the shared drive, revoke the vendor's credentials, preserve forensic images. Notification content depends on scoping; premature notice with wrong facts creates a second problem.
- Regulator first where the clock is shortest: The 72-hour sector clock is the binding constraint; file an initial notification even if incomplete, then update. Most regimes permit staged reporting.
- Law enforcement in parallel, not as a gate: Engage the FBI, but a request to delay disclosure does not override statutory deadlines. Coordinate wording; do not let it displace the legal clock.
- Individuals within the statutory window: 30 days is a ceiling, not a target. Once exfiltration of identifiable records is confirmed, notify promptly.
The board's 'wait until we understand it' instinct is the wrong frame: the obligation is to notify on reasonable belief of a breach, not certainty. Counsel should confirm whether the state law has a harm threshold and whether the sector regulator accepts phased reports.
2. What governance failure does the unapproved vendor reveal, and what control should be added?
Read the worked answer
This is a third-party risk governance gap, not merely a technical one. A remote-access tool entered production without approval, meaning the organization lacks (a) an inventory of vendor access paths, (b) a procurement gate that routes new tools through security review, and (c) contractual leverage - the missing breach-notification clause is a procurement failure.
Controls to add:
- Vendor access inventory reconciled against identity/access logs, so shadow IT is detectable.
- Procurement gate: no new external access without security sign-off; contract templates must include breach notification, audit rights, and incident cooperation.
- Least-privilege remote access with just-in-time credentials and logging.
- Board-level reporting on third-party concentration and access risk.
The deeper lesson: policy that exists only on paper (an 'approved vendor' rule) without a technical control to enforce it is not a control at all.