[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f5HuFd_xzTHImZlTOyAHTm4FHDKJ_z846n8QVmbHOCyY":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":33,"created_at":34,"published_at":35,"article":36,"tags":40,"podcasts":53,"controls":54},"6bf64ff6-e6e1-44bc-93b5-0f2093f0f5ee","bae-systems-contractor-incident-cripples-us-bankruptcy-court-notifications","51b82c79-f26b-42cf-88b1-867f3d4f65c7","BAE Systems Contractor Incident Cripples US Bankruptcy Court Notifications","A cybersecurity incident at BAE Systems, a third-party contractor managing critical US judiciary infrastructure, caused a nationwide outage of the Bankruptcy Noticing Center for over a week. This incident highlights the systemic risk of outsourcing mission-critical government services to external vendors without robust continuity safeguards. When a contractor's systems fail — whether from a breach, ransomware, or misconfiguration — the downstream impact can halt essential public services with no clear recovery timeline. The fact that the cause and data compromise status remain unknown after more than a week underscores serious gaps in incident detection, communication, and response planning. Government agencies must treat third-party contractors as an extension of their own risk surface.","**Immediate actions:**\n- Activate documented business continuity and fallback procedures to restore bankruptcy court notices through alternative channels.\n- Require BAE Systems to provide a detailed incident report including scope, cause, and data compromise status within a defined SLA window.\n- Conduct an emergency audit of all contractor-managed systems with access to sensitive federal judiciary data.\n\n**Long-term improvements:**\n- Establish mandatory contractual requirements for third-party vendors covering incident response timelines, breach notification, and minimum security controls.\n- Implement redundant, government-controlled backup systems for all critical contractor-managed services to prevent single points of failure.\n- Conduct annual third-party risk assessments and penetration tests on contractor infrastructure before contract renewals.\n\n**Detection & monitoring measures:**\n- Deploy continuous monitoring tools across contractor-managed environments with real-time alerting for anomalous activity.\n- Require contractors to integrate with government SIEM platforms so federal agencies retain independent visibility into service health and security events.\n- Establish defined Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) for all critical outsourced government services.",[12,13,14,15,16,17,18,19,20,21],"NIST SP 800-161 (Supply Chain Risk Management)","NIST IR-6 (Incident Reporting)","NIST CP-2 (Contingency Plan)","CIS Control 15 (Service Provider Management)","CIS Control 17 (Incident Response Management)","NIST SP 800-53 SA-9 (External Information System Services)","FedRAMP Third-Party Authorization Requirements","FISMA Section 3554 (Agency Responsibilities)","ITIL Service Continuity Management","ISO\u002FIEC 27036 (Supplier Relationships)",{"NIST CP-2 (Contingency Plan)":23,"NIST IR-6 (Incident Reporting)":24,"ITIL Service Continuity Management":25,"ISO\u002FIEC 27036 (Supplier Relationships)":26,"CIS Control 15 (Service Provider Management)":27,"FISMA Section 3554 (Agency Responsibilities)":28,"CIS Control 17 (Incident Response Management)":29,"FedRAMP Third-Party Authorization Requirements":30,"NIST SP 800-161 (Supply Chain Risk Management)":31,"NIST SP 800-53 SA-9 (External Information System Services)":32},"Contingency planning helps keep bankruptcy notices flowing when a contractor goes down.","Incident reporting requirements ensure contractors tell agencies quickly about incidents.","Service continuity management helps maintain critical services during supplier incidents.","Supplier relationship guidance covers managing risks of outsourced services.","Service provider management sets security and resilience requirements for contractors.","Requires agencies to ensure security of systems operated by contractors.","Incident response plans should cover third-party outages.","Third-party authorisation requirements set security standards for cloud services used by agencies.","Supply chain risk management covers assessing contractors like BAE Systems running critical services.","Requires oversight of external services, including contractor-run notification systems.","published","2026-10-16T12:20:16.193387+00:00","2026-10-16T12:20:16.174+00:00",{"id":7,"url":37,"slug":38,"title":39},"https:\u002F\u002Fwww.securityweek.com\u002Fbae-systems-security-incident-stalls-notices-from-us-bankruptcy-courts\u002F","bae-systems-security-incident-stalls-notices-from-us-bankruptcy-courts-58cf5a","BAE Systems Security Incident Stalls Notices From US Bankruptcy Courts",[41,47],{"id":42,"name":43,"slug":44,"description":45,"color":46},"182e11d5-57c4-444e-8ec8-4682ad60261b","Incident Response","incident-response","Slow detection, poor containment, missing playbooks","#14b8a6",{"id":48,"name":49,"slug":50,"description":51,"color":52},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[55,59,63],{"slug":56,"name":57,"problem":58},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",{"slug":60,"name":61,"problem":62},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",{"slug":64,"name":65,"problem":66},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it."]