A supplier telephoned on a Thursday afternoon to say their environment had been accessed and that we were among the customers affected. Only one question mattered after that, which was what of ours they held. It took us twelve days to answer it, and a regulator's clock does not pause for twelve days.
Our supplier register was excellent on everything except that. Contract value, owner, renewal date, service description, assurance questionnaire on file, two hundred and fourteen entries. Not one field describing what data the supplier processes, how much of it, for how long, or where.
We assembled the answer by asking people. The contract said claim documentation. Claim documentation turned out to include scanned identity documents, which nobody in my department had ever seen, and which operational staff had been attaching for years because the supplier's portal offers a general attachment field and a helpful person will use it. The retention we had contracted for was two years. They held nine. And the storage itself sat with a sub-processor whose name appeared only in an annex.
We notified the affected people late, and the reason was not the breach. It was that we could not describe our own exposure.
Supplier records now carry data categories, approximate volume, retention, sub-processors and processing locations, and those questions are asked before signature rather than during an incident. The existing population was worked through in order of sensitivity, which took a contractor four months and was the best money I spent last year. Six suppliers were still holding data for services that had ended, one of them since 2021, and a deletion instruction closed that.
We also rehearse the right scenario now. Our exercises had always assumed the breach was ours, in our systems, with our logs and our decisions and our timeline. Most of our data sits in other people's buildings, where we have no logs, no forensic access and no control over when we are told, and the only instrument we hold is a clause somebody negotiated years ago.
The most useful sentence in a supplier contract is the one recording what they have. Ours did not contain that sentence anywhere in two hundred and fourteen agreements.
– Serguey Shinder
