Your suppliers have owed you notice of exploited vulnerabilities since 11 September, and that duty has no deadline.
The authorities get 24 hours, then 72, then a final report. You get the words shall inform, with the timing left to a CSIRT's judgement if your supplier does not get round to it.