Vendor incident and vulnerability notification under CIP-013

No. CIP-013-2 is an obligation on the registered entity, not on its suppliers. The entity must have a supply chain cyber security risk management plan and procurement processes that address specific vendor topics, including incident notification, coordinated incident response and disclosure of known vulnerabilities. Vendors feel the standard through contract terms and questionnaires, because the entity uses them to show it has met its own requirements. A vendor therefore does not certify against CIP-013 itself. It can, however, prepare its notification commitments, response contacts and vulnerability disclosure process so they map cleanly to what an entity's procurement team will ask for. Confirm the exact language your customers need with their compliance team, since each entity writes its own plan.

The notice time should be set by working back from the entity's own deadlines, not picked as a standard number. CIP-008-6 requires the entity to notify within one hour after determining a Reportable Cyber Security Incident, and by the end of the next calendar day after determining an attempt to compromise an applicable system. A vendor that learns of an incident later than the entity needs it will leave the entity unable to meet those clocks. Contract language typically sets a vendor notice window, a required content list and a named contact path. Ask the customer which of its incident categories depend on vendor information, then agree a window the vendor can meet in practice. The right figure depends on the vendor's detection capability and the systems it touches, so it should come from the entity's plan rather than a template.

Not automatically. CIP-013-2 Requirement 2 requires the entity to implement its plan, but it does not require renegotiating or abrogating existing contracts, and contract terms and vendor performance fall outside that requirement. In practice, entities usually address gaps at renewal, through amendments or through addenda for new procurements. A vendor should expect customers to request notification, response and vulnerability disclosure terms in their next contract event, and should check whether current agreements already cover those topics. Whether a given contract needs an amendment is a question for the customer's legal and compliance teams, and the answer depends on the agreement's wording and term.

They set the floor for how fast the vendor must tell the entity about an incident. CIP-008-6 expects the entity to classify an incident, decide whether it is reportable and then notify within its defined windows. The entity's clock starts when it determines reportability, which depends partly on information the vendor holds, such as logs, indicators and affected software versions. Vendor terms therefore need to specify what the vendor sends, how quickly, to whom, and in what format, including updates while the vendor's investigation continues. Entities also need vendors to support root cause and lessons learned, because CIP-008 requires plan updates after response. Vendors should confirm these items with the customer and avoid promising reporting windows that conflict with the customer's own plan.

A vendor can support the response but cannot own it. The registered entity remains responsible for identifying, classifying and reporting Cyber Security Incidents under its CIP-008 plan, and for deciding whether an incident is reportable. A vendor can provide forensic data, containment steps on its own products, remote assistance under approved access and written technical updates. Those actions must run inside the entity's procedures and access rules, and the entity should record who authorized them. If a vendor offers managed response, the contract should state the division of roles, decision rights and escalation paths. Clarify this with the customer before any incident, because responsibilities agreed under pressure tend to be weak.

The entity's team needs to supply the decisions and access that only the entity can give. In most arrangements this includes a named incident contact, a documented escalation path, the systems and assets in scope, and approved access methods for vendor staff. The team also needs to confirm which CIP-008 classification applies, track reporting deadlines and keep the incident record. Before an incident, it should test the notification path with the vendor, usually in the plan's test exercises, and confirm that vendor contacts and contract terms are current. Vendors should ask the customer which of these items it will own so that no gap appears when an incident begins.

Cost depends on the work the vendor must add and who pays for it. The main drivers are the number of assets and systems the vendor supports, how much monitoring and logging it must provide, how fast notification must be, and how often the entity will test the process. Vendors usually carry the cost of building notification capability, staffing a response contact and producing incident reports. Entities carry the cost of their own plan, testing and reporting. Recurring costs include on-call coverage, plan reviews, exercises and contract administration. Ask any provider for a written quote that separates one-time setup from recurring support, and that states what each party is responsible for. No figure applies to every engagement, so the quote should follow from the agreed scope.

DeployOpen plans, implements and documents self-hosted open-source platforms inside the client's own infrastructure, and it runs security testing and cyber ranges. Where a client asks for help, DeployOpen can prepare the technical side of notification, such as logging, alerting, runbooks and test exercises for the systems it deploys, and can document the evidence that the client's process produces. DeployOpen does not act as the registered entity, does not decide whether an incident is reportable and does not issue audit reports or certifications. Scope, deliverables and timelines are agreed in writing before work starts, so confirm the boundary of responsibility in that document.