What it means
Supply chain incident response coordinates investigation and containment when a vendor, dependency, update channel, service provider, or trusted product may be compromised.
Why it matters
The organization may not control the source system, and the blast radius can cross products, customers, partners, and shared trust relationships.
Practical focus
- Identify affected products, versions, integrations, and trust paths
- Coordinate evidence and actions with suppliers
- Apply compensating controls while facts develop
- Track downstream exposure and communications
Common mistakes
- Waiting for the supplier to provide every answer
- Assuming a patch removes all persistence
- Ignoring credentials and trust relationships
- Communicating before verifying scope
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: