A cyber incident at a vendor: requesting information to assess the impact on the company

The following is a fictional scenario. Company A (a manufacturer with 300 employees that is preparing for a stock exchange listing) outsources the operation and maintenance of its order and inventory system to Company B. Company B has notified Company A: "Unauthorized access to the environment used for its work is suspected. The investigation is ongoing". Company A must determine which of its data could be affected and whether the situation calls for an explanation to Company C, its corporate customer, but Company B's explanation goes no further.

Company A, Company B, and the other elements of the scenario in this article are fictional and used for explanatory purposes. They do not describe actual matters handled by our firm.

When the vendor's explanation alone is insufficient for a decision

Communications from a vendor may be limited in the following ways.

• The data that could be affected has not been identified.
• The explanation says "not confirmed", but does not state the scope of the checks and how they were conducted.
• No indication is given of when the investigation will be completed.
• The vendor says it cannot comply when asked to provide a report.

At that point, a separate clock is running for the company: the deadlines for considering reporting to the authorities and notifying the individuals concerned, the response deadlines set by business partners, and the deadlines for internal reporting.

→ Checking reporting and notification obligations and the overall response

Checking the contract, the data concerned, and the responses received so far

Checking the contractual basis

The first step is to check the basis for the request.

An outsourcing agreement may include clauses on incident reporting, audits and on-site access, and the permissibility of subcontracting and the subcontractors involved. The "Model master agreement for outsourcing information system maintenance and operation" published by IPA likewise provides for communication arrangements in the event of incidents or failures to be set out in specifications or a separate document, and the clauses themselves do not necessarily specify reporting deadlines or the scope of reporting. First, check what the company's own contract provides.

When the handling of personal data is outsourced, the company, as the outsourcing party, has a duty to exercise necessary and adequate supervision over the vendor (Article 25 of the Act on the Protection of Personal Information). However, this duty of supervision alone does not mean that the company is automatically entitled to demand the full text of an investigation report held by the vendor. To obtain the necessary information, the company checks the contractual clauses on reporting and providing materials, as well as the reporting obligation if the arrangement constitutes a quasi-mandate (Article 645 of the Civil Code; under Article 656 of the Civil Code, this provision applies mutatis mutandis), and considers obtaining information through provision of the full text, excerpts of the necessary sections, written responses, or similar means. The reporting obligation under the Civil Code also cannot be equated with an obligation to hand over the full text of every existing document.

First identifying the facts the company needs for its decisions

Neither completion of the vendor's investigation nor receipt of its report is a prerequisite for the company's decision on reporting. Based on the facts known to the company and information from the vendor, the company determines whether the situation constitutes a reportable incident under the Act on the Protection of Personal Information and, if it does, submits a preliminary report using the information it has.

With that in mind, efforts to obtain information start not with "We want the report", but with which facts are needed for which decisions. If discussions concentrate on whether the report can be provided in full, progress in checking the necessary facts may stall. For an explanation to a business partner, it is necessary to know whether data that the business partner has entrusted to the company was accessed. If the necessary facts are identified, there are situations in which written responses or records of the work are sufficient, even without a deliverable in the form of a report.

Organizing the responses received so far

Oral explanations, emails, and reports given at regular meetings are arranged in chronological order and sorted into matters already confirmed and matters that remain unanswered.

This serves two purposes: duplicate questions can be avoided, and the counterparty can be shown which matters remain unanswered. Stating, for example, "Of the matters covered in your earlier explanation, we have not received an answer on [matter]" moves matters forward more than a vague request for materials.

→ When the company commissions an additional investigation

Matters to check with the vendor and decisions made without waiting

Matters to request from or confirm with Company B	Decisions to be made despite unresolved matters	Decision deadlines or timing	Examples of responsible departments at Company A
The Company A information concerned, the scope checked, and traces of access or similar activity	Determining, without waiting for Company B's final report, whether Company A needs to submit a preliminary report	Promptly after Company A becomes aware of a reportable incident*	Legal and information systems
Company B's reporting plans, the content of its notification to Company A, and arrangements for joint reporting and similar steps	Checking how reporting for Company A is to be carried out, without regarding the matter as handled merely because Company B will report	At a time that does not delay Company A's preliminary report	Legal and vendor management personnel
Written responses, excerpts, or similar alternatives when providing the full text of the report is difficult	Distinguishing unanswered matters from the rest and considering alternative checks and what to explain to Company C	Timing calculated backward from the contractual notification deadline / the agreed response date	Legal, information systems, and sales
Methods for further checking unanswered matters and the planned response date	Proceeding with Company A's final report and supplementary reporting even if Company B's investigation has not been completed	By the deadline for Company A's final report*	Legal and vendor management personnel

Note: These are illustrative entries for a fictional scenario. * The standard for a preliminary report is "promptly"; within approximately 3–5 days is the guideline. This does not mean that it is acceptable to wait that long. For a corporation, the starting point is when any of its departments becomes aware of a reportable incident. A final report is due within 30 days as a rule, or within 60 days for the category specified in Article 7, item (iii) of the Enforcement Rules for the Act on the Protection of Personal Information. If some matters remain unknown despite all reasonable efforts, the information already known is reported within the deadline, and the report is supplemented as soon as those matters become known.

Choosing among additional questions, report excerpts, and alternative checks

A report has not necessarily been prepared

To begin with, it cannot be assumed that the vendor has commissioned an outside investigation provider to investigate and that a report has been prepared. If the vendor is conducting checks with its own personnel, is still considering whether an investigation is needed, or has decided against outsourcing based on the scale and impact, there is no report to request.

The first points to check, therefore, are whether an investigation by an outside provider is being conducted, whether deliverables such as a report are planned, and, if so, when they will be prepared. If a report is requested before these points are checked, the vendor can only answer along the lines of "It does not exist yet", and the exchange does not move forward. The absence of a report cannot, by itself, be regarded as unusual or as a sign of insincerity.

Even at a stage when there is no report, there are methods such as written responses, provision of records of the work or logs, interviews with the vendor's personnel handling the matter, and additional investigation on the company's side. The sequence is the same here: the necessary facts are identified before information is requested.

Not starting with a request for the full text, even when a report exists

Even when a report has been prepared, requesting the full text at the outset is not necessarily appropriate. The vendor's investigation report may contain information unrelated to the company: information about other customers, the vendor's own confidential information, or information provided by third parties. If such information is included, it may take time to work out the scope of disclosure.

In addition, a refusal to provide the report cannot, by itself, be treated as evidence of concealment or negligence. This is because there may be legitimate reasons for the refusal.

A range of methods for obtaining information

Method	Suitable situations
Written responses to a questionnaire	Situations where the necessary facts have been identified
Excerpts of relevant sections of the report / redacted versions	Situations where the company wants to check the content itself
Viewing only (no copies taken)	Situations where the vendor is concerned about the materials being leaked
Interviews with the vendor's personnel handling the matter and confirmation of the minutes by both parties	Situations where no written deliverable exists yet
Checks by a third party (an investigation provider)	Situations where a technical assessment is needed
Additional investigation on the company's side	Situations where there is no clear prospect of obtaining the information from the vendor

Note: These are illustrative entries for a fictional scenario.

Among these methods, a questionnaire has the advantage that the answers can be kept in writing. This makes later disagreements such as "That is not how we explained it" less likely. When no report has been prepared, the main methods in the table above are written responses, interviews, and additional investigation on the company's side.

Setting the conditions for handling the information received

Before materials are received, the recipients, purposes, scope, and conditions for onward sharing are checked, and the necessary agreements are obtained. Also check the handling of third-party confidential information and personal information separately.

In addition, the period for which materials may be retained and the conditions for retaining copies needed to comply with laws and regulations or to deal with disputes are checked and discussed in advance. If conditions on returning or disposing of materials are accepted as they stand, the company may later be left without supporting materials when considering claims for costs or the allocation of responsibility. This is not a recommendation to continue retaining materials without permission.

→ Substantiating compensation and recovery costs by cost category

Designating the person responsible for requests and the approver of sharing conditions

The point of contact for inquiries and the questions to be asked are coordinated. If the information systems department and the legal department send separate inquiries, the vendor's response may become fragmented.

Routine information requests are approved by the person responsible for vendor management. If a request involves bearing additional costs or changing confidentiality conditions, approval is also sought from the authorized approver for that matter.

→ Arrangements for an alternate in an authorized approver's absence and clarification of authority across the company

Even when discussions about continuing the business relationship or responsibility are taking place in parallel, the purpose of obtaining the information, the information needed, and the response deadline are set out separately.

Recording requests, responses, unanswered matters, and deadlines

The following items are recorded:

• Date of the request
• Matters requested
• Basis for the request (contractual clauses, laws and regulations)
• Date and content of the response
• Unanswered matters
• Record of reminders
• Deadline

Of these, maintaining a list of unanswered matters is key. Whether the company can show that it "requested the information but did not obtain it" affects how easily it can explain the situation, both when the allocation of responsibility is considered later and when questions arise about whether it has provided the explanations required of it.

→ Explaining information obtained from the vendor to the company's business partners

When information is insufficient and cooperation is not forthcoming

In situations such as the following, we recommend considering the matter together with an analysis of the legal issues.

• When the facts needed for a decision have not been established by the reporting or notification deadline
• When the vendor does not cooperate and contractual measures need to be considered
• When considering the order in which to obtain information and prepare claims in circumstances where the vendor may also be the counterparty that the company seeks to hold liable
• When the development or maintenance contract itself is in dispute

There are aspects with which lawyers can assist in relation to information obtained from the vendor or an investigation provider, at the stage of organizing the information into a form that the company can use for decisions on reporting, explanations, and claims.

→ When disputes under development or maintenance contracts are at issue

→ Requesting from the vendor the information needed to decide on claims

Contact

Making an inquiry

Please let us know, as far as you are able, an outline of the explanation received from the vendor; the additional information being requested and the matters on which no response has been received; and the deadlines by which your company needs to make decisions and respond.

Contact Form

In your first message, please tell us the name of your company, the names of the parties involved and an outline of the matter. We will let you know whether we can advise after checking for conflicts of interest and similar matters. This form is not an emergency contact point, and we may not be able to review or reply to your message immediately after it is sent.

Related information

Related explainers and practice areas

Commissioning a cyber incident investigation: deciding on scope, deliverables, and additional costs

Outlines the scope, deliverables, and conditions for further investigation when the company commissions an investigation in light of information obtained from the vendor.

Initial and follow-up cyber incident reports: explanations and updates to customers and business partners

Outlines the content of responses and how to make corrections and updates when using the information obtained to provide explanations to customers and business partners.

System Development Disputes

Outlines how to respond when obligations or liability under development and maintenance contracts, contract termination, or damages are disputed.

This article is provided for general informational purposes only and does not constitute legal advice on any specific matter. Please consult us regarding your specific situation. The content is based on the laws and regulations in effect as of the date of the last update.