# Vendor Breach Cascade — Incident Response Record

## Case Information

| Field | Value |
|-------|-------|
| **Case ID** | [BREACH-YYYY-NNN] |
| **Vendor (Processor)** | [Vendor Legal Name] |
| **Vendor DPO/Contact** | [Name, Email, Phone] |
| **Severity Classification** | [Critical / High / Medium / Low] |
| **Current Phase** | [Initial / Assessment / Notification / Response / Post-Incident / Closed] |
| **Created** | [YYYY-MM-DD HH:MM UTC] |

## Vendor Notification Details

| Field | Value |
|-------|-------|
| **Breach Occurred** | [YYYY-MM-DD HH:MM UTC] |
| **Vendor Became Aware** | [YYYY-MM-DD HH:MM UTC] |
| **Vendor Notification Sent** | [YYYY-MM-DD HH:MM UTC] |
| **Notification Received by Summit** | [YYYY-MM-DD HH:MM UTC] |
| **Hours: Vendor Aware → Notification** | [X hours] |
| **DPA Timeframe (24h) Met?** | [Yes / No — exceeded by X hours] |

## Breach Description

**Nature of Breach:** [Confidentiality / Integrity / Availability / Combined]

**Description:** [Vendor's description of what happened]

**Data Categories Affected:**
- [Category 1]
- [Category 2]

**Estimated Data Subjects:** [Number]
**Estimated Records:** [Number]
**Containment Status:** [Contained / Ongoing / Unknown]
**Data Exfiltration Confirmed:** [Yes / No / Unknown]
**Multi-Tenant Breach:** [Yes / No]

## Cascade Timeline

| Timestamp (UTC) | Event | Actor |
|-----------------|-------|-------|
| [YYYY-MM-DD HH:MM] | Breach occurred at vendor | Vendor |
| [YYYY-MM-DD HH:MM] | Vendor detected breach | Vendor |
| [YYYY-MM-DD HH:MM] | Vendor notified Summit | Vendor |
| [YYYY-MM-DD HH:MM] | Summit acknowledged receipt | Privacy Team |
| [YYYY-MM-DD HH:MM] | Breach Response Team activated | BRT Lead |
| [YYYY-MM-DD HH:MM] | Risk assessment completed | DPO |
| [YYYY-MM-DD HH:MM] | SA notification decision made | DPO |
| [YYYY-MM-DD HH:MM] | SA notification filed | DPO |
| [YYYY-MM-DD HH:MM] | Data subject notification sent | Privacy Team |

## Risk Assessment (EDPB Criteria)

| Factor | Assessment | Score |
|--------|-----------|-------|
| Type of breach | [Confidentiality/Integrity/Availability] | [1-4] |
| Data sensitivity | [Low/Medium/High/Very High] | [1-4] |
| Ease of identification | [Difficult/Moderate/Easy/Very Easy] | [0-2] |
| Severity of consequences | [Low/Medium/High/Very High] | [1-4] |
| Volume of data subjects | [Small/Medium/Large/Very Large] | [1-4] |
| Special characteristics | [Children/Vulnerable persons: Yes/No] | [0-2] |
| **Total Risk Score** | | **[X]** |

**Risk Level:** [Unlikely to result in risk / Likely to result in risk / Likely to result in high risk]

**Assessor:** [Name, Title]
**Assessment Date:** [YYYY-MM-DD]

## Notification Decisions

### Supervisory Authority (Article 33)

| Field | Value |
|-------|-------|
| **Notification Required?** | [Yes / No] |
| **Decision Rationale** | [Explanation] |
| **Notification Filed** | [Yes / No] |
| **Filing Date** | [YYYY-MM-DD HH:MM UTC] |
| **72-Hour Deadline** | [YYYY-MM-DD HH:MM UTC] |
| **Within Deadline?** | [Yes / No] |
| **SA Reference Number** | [Reference] |
| **Phased Notification?** | [Yes / No] |

### Data Subjects (Article 34)

| Field | Value |
|-------|-------|
| **Notification Required?** | [Yes / No] |
| **Decision Rationale** | [Explanation] |
| **Exemption Applied?** | [Art. 34(3)(a)/(b)/(c) or None] |
| **Notification Sent** | [Yes / No] |
| **Notification Date** | [YYYY-MM-DD] |
| **Method** | [Email / Public Communication] |
| **Data Subjects Notified** | [Count] |

## Vendor Remediation

| Item | Status | Due Date | Completed |
|------|--------|----------|-----------|
| Root cause analysis | [Status] | [Date] | [Date] |
| Containment confirmation | [Status] | [Date] | [Date] |
| Remediation plan submitted | [Status] | [Date] | [Date] |
| Remediation implemented | [Status] | [Date] | [Date] |
| Verification audit conducted | [Status] | [Date] | [Date] |

## Liability and Contractual Actions

| Item | Status | Notes |
|------|--------|-------|
| DPA breach notification timeliness | [Compliant / Non-compliant] | [Details] |
| Vendor cooperation adequate | [Yes / No] | [Details] |
| Contractual remedies assessed | [Yes / No / N/A] | [Details] |
| Indemnification claim | [Yes / No / N/A] | [Details] |
| Vendor risk score updated | [Yes / No] | [New score/tier] |

## Post-Incident Review

**Lessons Learned:**
1. [Lesson 1]
2. [Lesson 2]

**Process Improvements Identified:**
1. [Improvement 1]
2. [Improvement 2]

**Review Completed By:** [Name, Title, Date]

---

*This record is maintained per GDPR Article 33(5) documentation requirements and the Summit Cloud Partners Breach Management Policy.*