Dark Vendor, Clear Clock: The Board's First 180 Minutes After a Critical Supplier Fails

Supplier failure rarely arrives with a tidy notification. More often the first sign is a silent integration, an unanswered account manager, a status page that has not updated since Friday, or a ransomware note forwarded by a client. For a UK board, the question is not whether a critical vendor can fail. It is whether the first 180 minutes produce disciplined decisions or a spiral of unverified briefings. The drill below is designed to be rehearsed, not read for the first time in a crisis.

Minute 0-30: Establish the facts, not the narrative

The board's first instinct should be to resist the first story. A vendor outage, a cyber incident, an insolvency filing and a contractual withdrawal are different events with different legal and regulatory consequences. Assign one executive owner to maintain a single incident log. That log should record what is known, what is assumed and what is still unverified, with timestamps and named sources.

Ask three questions immediately. First, is the vendor unreachable, degraded or formally withdrawn? Second, does the event involve data, including personal data or confidential client information? Third, which business processes stop if the vendor does not return today? The answers determine whether the board is dealing with a continuity problem, a data protection problem, a financial problem or all three.

If personal data may be affected, the data protection officer should be engaged within the first half hour. Under UK GDPR, the 72-hour notification clock to the Information Commissioner's Office is not a board-level aspiration; it is a hard deadline that begins when the controller becomes aware of a personal data breach. The board does not need every fact at minute 30. It needs the right people collecting them.

Minute 30-60: Protect customers and operations

By the end of the first hour, the conversation should shift from diagnosis to consequence. Map the vendor to the processes it supports and rank those processes by customer impact, regulatory obligation and revenue exposure. A payroll provider, a payment processor, a cloud host and a facilities contractor do not carry the same risk profile. The board should see the top five affected processes, not a comprehensive inventory.

Operational workarounds must have named owners. If a manual process can bridge the gap for 48 hours, say so and resource it. If it cannot, the board needs to know which customer commitments will be missed and who will communicate that. In regulated sectors, the board should also confirm whether the event triggers operational resilience obligations, outsourcing rules or sector-specific notification duties. The Prudential Regulation Authority and Financial Conduct Authority expect firms to have impact tolerances for important business services; a vendor failure is precisely the moment those tolerances are tested.

Customer communication should be accurate and restrained. A holding statement is acceptable. Speculation is not. The board should agree who speaks to major customers, who speaks to the regulator and who speaks to the workforce. In the first hour, silence is often better than a premature explanation.

Minute 60-120: Contracts, data and regulatory exposure

With continuity under way, the board should turn to exposure. Legal counsel should review the contract for termination rights, force majeure, service credits, step-in rights, escrow arrangements, subcontractor obligations and notification periods. These clauses are not academic. They determine whether the company can recover costs, access data or replace the vendor without breaching its own customer contracts.

Data access is the next pressure point. If the vendor holds company or customer data, the board must confirm whether backups are available, whether credentials remain under company control and whether the vendor's failure could compromise confidentiality or integrity. Cyber incidents require a separate escalation route: the National Cyber Security Centre offers guidance and, in some cases, incident support, while insurers should be notified promptly under the terms of the policy.

Regulatory notification should be considered in parallel, not after the event. Listed companies must assess whether the vendor failure constitutes inside information and whether disclosure obligations are engaged. Sector regulators may require notification of material outsourcing failures. The board should not delegate this assessment to a single function without a documented second opinion.

Minute 120-180: Decide, assign, escalate

The final hour is for decision discipline. The board should agree a small number of immediate actions, each with an owner, a deadline and an escalation trigger. It should also decide what it does not need to decide today. Micro-management during a vendor failure is a symptom of poor preparation, not strong governance.

Record the decisions in a contemporaneous log. Note who attended, what was known, what was assumed and why a particular course was chosen. If the event later becomes a regulatory enquiry or a customer dispute, that log will be more useful than a polished retrospective. The board should also set the next checkpoint: a 24-hour review, a 72-hour review and a post-incident lesson-learning session.

A 2026 drill checklist for UK boards

• Maintain a critical vendor register with named executive owners and escalation contacts.
• Pre-agree the trigger for convening an emergency board call and the quorum required.
• Keep a one-page summary of key contract clauses for each critical supplier.
• Map personal data flows and confirm the 72-hour UK GDPR notification process.
• Identify regulatory notification routes by sector and by entity.
• Prepare holding statements for customers, employees and regulators.
• Confirm insurance notification requirements and legal privilege protocols.
• Test evidence preservation and decision logging at least once a year.

The three-hour frame is not a guarantee of a perfect outcome. It is a defence against drift. A board that can verify facts, protect customers, understand its legal exposure and record its decisions within 180 minutes is far better placed than one that spends the first day waiting for a complete picture. In supply-chain crises, the complete picture rarely arrives on time.