A business partner's systems connect directly to the environment that has been compromised, and responders believe the partner may also be at risk. What should the security manager do?
Select an answer to reveal the explanation.
Short Explanation
If a fire in your building might spread next door, you knock on your neighbour's door, and you use the number you agreed on beforehand. Cutting their connection silently or blasting the news publicly are both wrong turns.
Full Explanation
Interconnected third parties can be affected by an incident through shared connections, credentials or data flows, and contracts and interconnection agreements commonly require prompt notification through designated security contacts. Notifying the partner through the agreed channel allows it to assess its own exposure, apply containment measures and coordinate with the organization, while keeping sensitive information within an appropriate, confidential relationship. Legal counsel may advise on content and timing. Disconnecting the partner's connection without telling them may be a valid containment step, but doing so silently leaves the partner unaware of the risk to its own environment, may breach contractual obligations and disrupts its operations without explanation. Posting a notice on a public status page discloses incident details publicly, may alert the attacker and is not a secure or agreed channel for sensitive coordination. Waiting until the investigation is complete delays the partner's ability to protect itself, potentially allowing the attacker to move into its environment, and may violate notification terms. Exam caveat: the content shared should be appropriate to the partner's need, and information-sharing terms should be agreed in advance. Operational check: confirm the partner's security contact details are current in the plan and that each notification is logged.