The Cyber Incident That Tests Your Incident Command
You are the CRO of a mid-size insurer. At 2 a.m. Saturday, your security team detects ransomware in a third-party claims-processing vendor's environment. The vendor processes 40% of your claims and holds policyholder data. By 6 a.m.: the vendor says 'containment is in progress,' your claims operation is degrading, and a journalist has emailed asking for comment. Your CEO is unreachable on a flight. The board chair texts asking if this is 'a big deal.' Your communications lead wants to issue a statement; legal wants silence; the vendor wants to handle messaging jointly. You have no pre-agreed playbook for vendor-originated incidents.
1. What decisions must you make in the first hours, and in what order, given the information gaps?
Read the worked answer
Sequence decisions by irreversibility and harm: protect people and operations first, then information, then reputation.
- Activate incident command under the CRO or a designated incident lead. Establish a single decision log with timestamps - regulators and boards will ask.
- Assess operational continuity: can claims be processed? Activate manual/alternate processing and notify affected business units.
- Assess data exposure: what policyholder data does the vendor hold, and is it confirmed exfiltrated? Do not accept 'containment in progress' as a data-breach conclusion.
- Engage counsel to preserve privilege and map notification obligations (regulatory, contractual, state breach laws) - deadlines are often short.
- Control the narrative internally: brief the board chair with what is known, unknown, and the next checkpoint. Do not speculate.
- Hold external messaging until facts support it, but prepare a holding statement; silence past a reasonable window becomes its own story.
- Do not cede messaging to the vendor. You own the policyholder relationship; joint messaging must be coordinated, not delegated.
The governing principle: decide what you can decide now, and set explicit checkpoints for what you cannot.
2. The board chair asks whether this is 'a big deal.' How do you answer, and what governance follow-up do you commit to?
Read the worked answer
Answer honestly with a structured uncertainty statement: 'It is potentially material. We have confirmed X (vendor holds 40% of claims and policyholder data), we do not yet know Y (whether data was exfiltrated), and we will know more by [time]. I am treating it as a significant operational and regulatory event until facts say otherwise.'
Governance follow-up you commit to:
- A written incident brief to the board within 24–48 hours covering facts, decisions, and notification obligations.
- A post-incident review covering vendor concentration risk, contract terms (notification, audit, liability), and the absence of a vendor-incident playbook.
- A board-level discussion of third-party concentration: 40% of claims through one vendor is a resilience gap, not just an IT issue.
- Tabletop exercises for vendor-originated incidents.
This converts an ad hoc crisis into a governance learning event and gives the board a defensible record of oversight.