Telling a customer something happened

Reporting to the government is not telling your customer

The clause directs a report to a government portal. Whether and when you tell the prime contractor or the agency you work for is governed by your contract with them, by the relationship, and by judgement.

Suppliers routinely satisfy the first and delay the second, on the reasoning that they will have more to say later. That reasoning is understandable and it is usually wrong.

Why waiting for the full picture costs more

A customer who learns early receives a partial account from you. A customer who learns late receives a complete account and also learns that you knew for three weeks.

The second fact is the one that damages the relationship, and it is independent of how well the incident was handled.

Early does not mean speculative. It means: this happened, this is what we know, this is what we do not yet know, this is what we are doing, and we will update you on a stated day.

Five things, and no more

• What happened, factually, with times.
• What information was or may have been involved.
• What you have done so far.
• What you are doing next, with a date.
• Who they should contact and how.

Written by one person, reviewed by counsel where the stakes warrant it, and sent by somebody senior enough that the recipient understands it is being taken seriously.

Four things that make it worse

Speculation about cause. Particularly attribution. It is frequently wrong and it is quoted back.

Blame. Of a vendor, an employee or the customer's own systems. Even where accurate, it reads as deflection at this stage.

Assurance you cannot support. "No data was affected", said before the analysis, is the sentence most likely to be retracted and most damaging when it is.

Silence after the first notification. An update on the promised day, even one saying that the analysis continues, is worth more than a complete report a week late.

Speed against review

Counsel will want to review what goes out and review takes time. The resolution is a template agreed in advance, so that the first notification is a form with facts inserted rather than a document drafted from nothing under pressure.

Agree the template while nothing is happening and the tension mostly disappears.

Three groups often forgotten

Your own staff, who will hear something and construct the rest. Other customers, if the same systems serve them. And your insurer, whose policy may require notice sooner than anybody else.

Tell them what changed

A short note when the review is complete, saying what was found and what has been altered, closes the matter properly. Suppliers who do this are remembered for handling it well; suppliers who go quiet are remembered for the incident.

Elsewhere in when something happens

• What compliance actually costs, itemisedWhat compliance actually costs, itemised. What it costs, who decides, and what usually goes wrong.
• Reading a proposal that quotes a certificateReading a proposal that quotes a certificate. What it costs, who decides, and what usually goes wrong.
• What to build and what to buyWhat to build and what to buy. What it costs, who decides, and what usually goes wrong.
• Making the budget case to somebody who resents itMaking the budget case to somebody who resents it. What it costs, who decides, and what usually goes wrong.
• The costs that arrive after the purchase orderThe costs that arrive after the purchase order. What it costs, who decides, and what usually goes wrong.
• Doing this with almost no moneyDoing this with almost no money. What it costs, who decides, and what usually goes wrong.
• Who owns compliance, and why it cannot be nobodyWho owns compliance, and why it cannot be nobody. What it costs, who decides, and what usually goes wrong.
• Running it as a project rather than as a documentRunning it as a project rather than as a document. What it costs, who decides, and what usually goes wrong.
• Reporting to a board that wants one numberReporting to a board that wants one number. What it costs, who decides, and what usually goes wrong.
• When the date slips, which it willWhen the date slips, which it will. What it costs, who decides, and what usually goes wrong.
• Staying compliant after the assessmentStaying compliant after the assessment. What it costs, who decides, and what usually goes wrong.
• Working to two standards at onceWorking to two standards at once. What it costs, who decides, and what usually goes wrong.
• Training that changes what people doTraining that changes what people do. What it costs, who decides, and what usually goes wrong.
• How a control looks from the machineHow a control looks from the machine. What it costs, who decides, and what usually goes wrong.
• Contractors, temps and the visiting engineerContractors, temps and the visiting engineer. What it costs, who decides, and what usually goes wrong.
• Hiring for a role most suppliers have never filledHiring for a role most suppliers have never filled. What it costs, who decides, and what usually goes wrong.
• Giving people a way to say a control is unworkableGiving people a way to say a control is unworkable. What it costs, who decides, and what usually goes wrong.
• What staff are told about monitoringWhat staff are told about monitoring. What it costs, who decides, and what usually goes wrong.
• What counts as an incidentWhat counts as an incident. What it costs, who decides, and what usually goes wrong.
• Reporting obligations and their clocksReporting obligations and their clocks. What it costs, who decides, and what usually goes wrong.
• Being able to answer afterwardsBeing able to answer afterwards. What it costs, who decides, and what usually goes wrong.
• The first hour, and who decidesThe first hour, and who decides. What it costs, who decides, and what usually goes wrong.
• What changes afterwards, and what shouldWhat changes afterwards, and what should. What it costs, who decides, and what usually goes wrong.
• The other frameworks you have also metThe other frameworks you have also met. What it costs, who decides, and what usually goes wrong.
• Export control, named and not advised onExport control, named and not advised on. What it costs, who decides, and what usually goes wrong.
• Your own suppliers, and what to ask themYour own suppliers, and what to ask them. What it costs, who decides, and what usually goes wrong.
• Suppliers outside the United StatesSuppliers outside the United States. What it costs, who decides, and what usually goes wrong.
• Where the data physically sitsWhere the data physically sits. What it costs, who decides, and what usually goes wrong.
• What is changing, and how to tellWhat is changing, and how to tell. What it costs, who decides, and what usually goes wrong.