How do you balance the need for accountability with the desire to maintain a positive relationship with your vendors after a major incident?
Sort By:
Oldest
CIO in Healthcare and Biotech13 days ago
Accountability and transparency are critical. One thing I always do is ask for a Root Cause Analysis from the vendors. It doesn't have to be a catastrophic incident; it could be a minor blip that shouldn't have happened. The quality and speed of the RCA from different vendors give me a comfort level that they will take these issues seriously. If a vendor can deliver a well-researched RCA in about a week, explaining what happened and what steps are being taken to prevent it from happening again, it shows accountability. On the other hand, avoiding accountability and transparency is a quick way to make me consider replacing the vendor when their contract is up.COO13 days ago
Fortunately, I have only been part of one real-world incident that warranted a disaster recovery or executing an BC plan. While I was with JP Morgan, we were under a DDoS attack. At the time, I was the CTO at JP Morgan, and there were only four of us globally. The attack was significant, and you can imagine the chaos when they started messing with people's money. The Twitter feeds lit up quickly with questions about what was going on. We soon realized it was bigger than us; it involved Citibank and Bank of America as well.Long story short, we had to come together because our third-party vendors couldn't help us. The banks met at 3:00 AM on a conference call, trying to figure this out, and had to meet several more times over the next few days. Eventually, we were able to engage the US government, who then worked with local officials of another country to shut it down. Interestingly, the incident made national news as a "computer glitch" affecting major banks, but we knew it was a DDoS attack.
Being a large bank, we had access to vendors and resources that most companies don't have. Despite this, there was nobody to help us initially. However, the vendors we did work with, like Cisco and Fortinet, were incredibly accountable. They stood by us, participated in conference calls, and were present in the war room. It was a pleasant surprise, and I didn't have to balance accountability; it existed naturally with my vendors.