Identify the affected service
Name the vendor, product, service, contract owner, business processes and customers affected.
Preserve the contract set
Keep the executed agreement, amendments, service levels, data terms, indemnities, liability caps, security schedules and insurance requirements.
Give required notices
Track insurer, broker, vendor, customer, regulator and contractual notices separately.
Confirm response authority
Record which party may appoint counsel, forensics, restoration or communications vendors and what insurer consent is required.
Request vendor evidence
Seek incident chronology, affected systems, relevant logs, findings, restoration status, customer impact and insurer information where appropriate.
Document internal loss
Keep downtime, work-around, labor, revenue, customer-credit, restoration and extra-expense records.
Track shared decisions
Record meetings, instructions, assumptions, disputed facts and changes in scope.
Separate recovery paths
Distinguish the insurance claim, contractual recovery, indemnity, vendor credit, customer claim and regulatory response.
Avoid double recovery
Coordinate payments, credits and reimbursements so the same loss is not presented twice.
Review before closure
Confirm open claims, evidence retention, subrogation or recovery rights, settlement language and lessons for renewal or contracting.