Name the authority before the incident. A good rule: the incident lead, or an on-call security engineer acting for them, may block a package, freeze dependency updates or pause builds immediately, with a duty to tell the accountable executive and review the action afterwards. Debating authority during a compromise costs hours.
Why it needs writing down
Normal approval chains are slow by design. An active supply chain incident needs the opposite: one person who can act. CSF 2.0 outcome GV.SC-08 says relevant suppliers and other third parties are included in incident planning, response and recovery, and GV.SC-02 says roles and responsibilities are established and communicated. Emergency authority is where those two meet.
What emergency authority should cover
| Action | Who may do it | Notes |
|---|---|---|
| Block a package or version in the internal registry or proxy | Incident lead or delegate | Reversible |
| Freeze automated dependency updates | Incident lead | Time limited |
| Pause builds or deployments for named services | Incident lead, with service owner told | Business impact, report to executive |
| Revoke credentials that the package could have exposed | Incident lead with security | Plan the rotation |
| Public statement or customer notice | Executive and legal | Not an incident lead decision |
Note the last row. Emergency authority covers containment, not communication with the outside world.
Pre-incident preparation
- Write the authority into the incident response plan and the decision rights matrix. See supply chain decision rights matrix.
- Make blocking easy. If you have an internal registry or proxy, a block should take minutes.
- Know where each package is used. You cannot block what you cannot find, and an inventory shortens that search from days to minutes.
- Pre-approve a rollback path for the most critical services.
- Practice. A tabletop exercise on a compromised dependency exposes missing permissions.
After the action
Within a day, the incident lead writes a short record: what was blocked, why, who was told, expected impact and when it will be reviewed. Within a week, the review group decides whether the block becomes policy, is lifted, or is replaced by a fix. A temporary block with no review date becomes a quiet permanent rule.
Pitfalls
- Authority held by a single named person who is on holiday. Always name a deputy.
- Blocks that fail because the registry is not the sole path. Check direct downloads and cached layers.
- No customer-impact check. Pausing deploys for a payment service has a cost.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how quickly you can see which of your services use an affected component.
Safeguard's zero-day discovery and SBOM and dependency scanning help find where a package is used, and its policies and gates can stop it from entering new builds.
Quick check
Should the CISO approve every emergency block?
No. Pre-delegate to the incident lead and review afterwards.
Is a block permanent?
It should have a review date. Decide whether to lift it, replace it with a fix or write it into policy.
Sources
Last reviewed: 19 October 2026.
