Put security-incident communication in the accounting contract

Ask the provider what events trigger notice under the proposed agreement. Distinguish a suspected exposure, confirmed unauthorized access and a service outage. Each can require a different response. The company needs enough visibility to assess its own risk without treating every minor technical interruption as a confirmed breach.

FTC guidance recommends that businesses require service providers to notify them of security incidents. Agree the actual contractual trigger and timing with security and legal advisers. Avoid language that requires the provider to complete a lengthy investigation before reporting a credible event affecting your records.

The initial notice should identify the known event, affected service, available timing, potentially involved information and the provider's immediate contact. Require uncertainty to be labeled. Management can begin assessing exposure with incomplete facts if the limits are clear; an unsupported assertion that everything is safe can delay necessary decisions.

Name primary and alternate company contacts outside the ordinary accounting inbox. Agree a secure communication route if the usual portal or email system is affected. Keep the route usable during a staff absence and confirm who inside the company convenes security, legal and operational decision-makers.

Ask what evidence the provider can supply about affected records, access and containment. Agree an update cadence proportionate to the event and a method for correcting earlier information. The company should know when the next update is due even when the investigation has not reached a conclusion.

FTC breach-response guidance emphasizes preserving evidence and involving appropriate expertise. Discuss how the provider will cooperate with a coordinated investigation and avoid destroying relevant logs during remediation. Keep technical containment decisions with the responsible specialists, subject to the company's actual authority over its systems.

Identify subcontractor involvement and the provider's role in obtaining information from them. A promise to relay messages may be insufficient if the company cannot learn which data was affected. Ask the contracting provider to state the cooperation it can actually commit to under its own supplier arrangements.

Have counsel determine applicable notifications to authorities or affected individuals using the actual facts and jurisdictions. The contract can allocate cooperation and communication responsibilities without substituting for those legal requirements. Avoid publishing a provider's preliminary explanation as a final company statement before it has been reviewed.

Keep the return to service and restoration of access as separate decisions. Ask what evidence will support reopening a connection and who approves it. A recovered portal does not necessarily establish that the cause has been understood or that all affected information has been identified.

Request a final account appropriate to the event: facts established, information affected, actions taken, remaining limitations and agreed corrective work. Clarify any cost allocation and insurance coordination through the governing terms and qualified advisers. Do not assume a general security promise guarantees compensation for every consequence.

Ask whether the provider can deliver updates without using the affected system. Record an independently verified contact route and test that the company can receive an urgent notice through it.

Set a follow-up date for verifying agreed changes. Update contacts, permissions or service arrangements based on the evidence. Retain the incident record securely and keep routine accounting staff informed of operational changes without distributing sensitive investigation detail beyond those who need it.