Across Boundaries: Suppliers, Managed Providers, Sector Exercises and Authorities

All courses / AI Purple / Module 5 / Chapter 22

Learning objectives

After the lesson the participant can:

Classify a test that crosses a provider boundary as pipeline, response chain or provider platform, and state the permission each needs.
Draft a consent and notice protocol for a test across a provider boundary.
Explain what may leave the organisation in sector sharing and what stays inside, by handling class.
Design the disclosure routes for a vulnerability found in a supplier's product and for a report about one's own estate.

Key concepts

Three boundary crossings: Through the provider's pipeline, with a seeded incident in its queue; through the provider's response chain, with a scenario on one's own estate; and against the provider's platform, which is outside the organisation's authority and excluded in every manifest.
Standing consent and window notice: Standing consent is given once in the contract: test classes, synthetic seeds, the stop right and knowledge rules. Window notice precedes each run, by default ten working days for a managed provider, without saying which cases are tests.
Sanitiser: A deterministic export that passes an allow-list of fields and drops everything else, followed by a person's release. The technique identifier, portable detection logic and aggregate results may leave; the target mapping, the gap list and findings stay inside.
Coordinated vulnerability disclosure: A weakness in a supplier's product goes to the supplier and, failing an answer, to the CSIRT designated as coordinator under NIS 2 Article 12(1). The test stops at proof. The organisation also publishes a channel for reports about its own estate.
One loop, local manifests: For a group in several legal regimes, the stage records and handling classes are the same everywhere, and each entity has its own rules-of-engagement manifest reflecting local law, consent and transfer rules.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Interactive exercise 1 · Match

One loop, local manifests

Match each part of Hansa Mutual's group with what the loop does differently there, according to the chapter's cross-border table.

Interactive exercise 2 · Scenario

A supervisor asks for the gap list

Apply the chapter's rules on evidence to supervisors to a request at Hansa Mutual.

Teaching plan

15 min	The teacher presents the three crossings and where the stop path and the question of what can be undone cross the boundary too.
15 min	Participants compare the cloud providers' rules in the chapter's table and draw the two lessons: the rules disagree and change, so the protocol records the page and the date.
35 min	Exercise: write a consent and notice protocol for a test that crosses a managed provider's boundary.
15 min	Sorting task: twelve items from a loop's records are placed in can leave or stays inside, with a Traffic Light Protocol marking for those that leave.
10 min	Plenary on disclosure in both directions and on the supervisor package, where the gap list is inspected and not copied.

Discussion

A log that cannot cross a border is a coverage gap, recorded as one. How should a group explain such a gap to a board that expects one loop for the whole group?
Detections received from peers are untrusted input and a draft. What would a loop need to do before a shared detection counts towards coverage?
A supervisor has the authority to demand the gap list and the organisation has a duty to protect it. Why does the chapter settle on inspection rather than a copy?

Written exercise

Exercise · 35 minutes

A consent and notice protocol

Write a consent and notice protocol for one test of your own organisation, or of Nordvik Region, that crosses a managed provider's boundary. Following the nine steps of the practical guide, classify the crossing and refuse any test against the provider's platform. Record the standing consent the contract annex must contain. If a cloud provider is involved, note which published rules you would read and that you record the page and the date. Set the window notice and its contents. State what the provider may and may not know during the run. Name the stop holders on both sides with deputies and the instrument each uses. Name the stop condition for a vulnerability found in the provider's own service. State the data rule and what the provider receives for each seed.

Deliverable: A one-page protocol from which a reader can name the provider, the clause, the date of notice, the stop holders on both sides and the data rule.

Your work

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

Which of the three ways of crossing a provider boundary is excluded in every manifest?
Show the answer
B. Probing the provider's own platform, its other customers' tenants or its staff.
Testing against the provider's platform is outside the organisation's authority to permit and is excluded in every manifest. The pipeline and response-chain crossings are allowed with the provider's consent given in advance in the contract.
What may leave the organisation in sector sharing, under the chapter's rule?
Show the answer
A. The technique identifier, portable detection logic and aggregate results, after a person's release.
The rule is to share the technique and the expected evidence and never the target mapping. FC-1 and FC-2 content leaves through a deterministic sanitiser and a named release authority; systems, the gap list, findings and evidence stay inside.
During an authorised test, a weakness is revealed in a supplier's product. What does the chapter prescribe first?
Show the answer
C. The test stops at proof and the weakness is reported to the supplier, with the CSIRT coordinator as fallback.
The test stops at proof, the line of testing ends, and the report goes to the supplier. Where the vendor has no channel or does not answer, NIS 2 Article 12(1) provides the CSIRT designated as coordinator.