How do you manage an incident involving multiple vendors?

What is happening

A managed service provider, a software vendor, a forensic firm, internal IT, counsel, an insurer, and leadership are all engaged. Each is competent. Each holds a different portion of the facts, works to a different scope, and reports to a different person. Within a day, there are several versions of the story and no one can say what has already been changed.

What to establish immediately

• One incident coordinator with the authority to sequence work across parties.
• One chronology and one decision log, accessible to all parties, maintained by a named scribe.
• A change-control rule: no party modifies an affected system without logging it centrally first.
• Written scope per party — what each is engaged to do and explicitly not do.
• A single reporting cadence with a fixed time, and one report format for leadership.
• A single approved channel for external and customer communication.
• A confirmed contact and escalation path for each party, including out of hours.

What not to do

• Do not let each vendor report separately to a different executive.
• Do not allow parallel remediation on the same systems without sequencing.
• Do not rely on a group chat as the record.
• Do not let contractual disputes over responsibility begin while containment is still in progress — note them and return to them later.
• Do not assume a vendor has told you everything they know; ask specific questions.

Questions to ask

• Who is coordinating, and does every party know that?
• What has each party already changed?
• What is each party contractually obligated to do here?
• Where is the authoritative record, and who maintains it?
• Which decisions are waiting on which party, and by when?

Warning signs

• Two parties give leadership different timelines on the same day.
• Remediation actions appear that no one on the call authorized.
• Vendors are answering questions defensively rather than factually.

When outside help may be appropriate

When no internal person has both the availability and the standing to direct several external parties at once, or when the organization needs coordination that is independent of any vendor whose performance may later be examined.