ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
Business continuity supply chain risk is the chance that a failure at a supplier, a supplier of that supplier or a logistics link interrupts your critical activities beyond what you can tolerate. Recent years showed how quickly a single point of failure upstream can stop production, service or delivery.
This guide explains how to map dependencies, assess supplier resilience, write continuity terms into contracts and prepare alternatives. It complements your supplier continuity assessment, risk register and threat assessment.
Modern operations rely on many external parties, and disruption often arrives through them. Loss of a single provider can stop critical activities even when your own plans are sound.
ISO 22301:2019, listed at ISO 22301:2019 on iso.org, expects organizations to consider dependencies on suppliers and partners in their analysis and planning, so supplier resilience belongs inside the continuity programme.
Begin with your critical activities and list what each one needs: services, components, data, staff and facilities from outside. Follow the chain at least one tier down for the most critical items, since your supplier may depend on a single source too.
Use the results of your dependency mapping and mark suppliers whose loss would exceed the tolerance for an activity.
Keep a simple inventory with the supplier name, service, criticality tier, contract end date, recovery objectives, location, key subcontractors, contact details and last assessment date. A current inventory answers most questions in the first hour of an incident and makes reviews quicker. Assign someone to update it whenever contracts change, and reconcile it against procurement records each year.
Look for sole suppliers, single sites, shared subcontractors and concentration in one region or one cloud provider. Each is a candidate for treatment. The guide to single point of failure analysis provides a method.
Rank the findings by the impact on critical activities and the effort needed to reduce exposure.
Assign a named owner for each critical supplier relationship, usually the business manager who depends on it, with support from procurement, risk and the continuity lead. The owner is responsible for keeping the file current, scheduling reviews and raising concerns. Report supplier continuity risk to management alongside other continuity risks, and include overdue assessments and open gaps in the dashboard so problems do not sit in procurement files.
Not every supplier needs the same scrutiny. Tier them using impact analysis results: critical suppliers get full assessments and testing, important ones get periodic questionnaires and routine ones rely on standard terms. Keep the tiering current as the business changes.
| Supplier type | Typical failure | Evidence to request | Mitigation |
|---|---|---|---|
| Cloud or IT provider | Regional outage, cyber attack | Recovery objectives, test results | Multi-region design, exit plan |
| Sole-source component maker | Plant shutdown, insolvency | Site locations, stock policy | Buffer stock, second source |
| Logistics provider | Strike, port closure | Alternative routes, capacity | Multiple carriers |
| Outsourced service centre | Staff loss, power failure | Continuity plan, test dates | Failover site, step-in rights |
Ask for evidence rather than assurances: continuity plans, recent test results, recovery objectives, certifications, subcontractor lists and incident history. Compare their objectives with the recovery time your activities need. If the supplier cannot commit to a time that fits your tolerance, record the gap as a risk.
Site visits or audits are worth the effort for the most critical suppliers.
Suppliers will not always accept every clause, so decide which terms are essential and which are desirable. Essential items often include incident notification, recovery objectives that fit your tolerance, permission to test or audit and help with an orderly exit. Where a supplier refuses, record the residual risk and treat it elsewhere, for example by adding an alternate. Keep a note of what was requested and why, as it helps at renewal.
Contracts should set out notification duties, recovery objectives, testing rights, subcontractor controls, step-in or exit assistance and clear service credits. For regulated firms, there may be mandatory clauses, so check the rules that apply to you.
Involve legal and procurement early, since terms are hard to change after signature.
For critical suppliers, decide what you would do if they failed: switch to a second source, bring the work in house, hold stock or run a manual workaround. Document the plan, the time it would take and any pre-conditions such as onboarding an alternate.
An exit plan that has never been examined is a hope, not a plan, so test at least the key steps.
Several regulators expect firms to manage the continuity of critical third parties. In the European Union, the Digital Operational Resilience Act, Regulation (EU) 2022/2554, sets requirements for financial entities on ICT third-party risk, including contractual provisions and exit strategies. Other sectors have their own supervisory statements. Check which rules apply to you and confirm current wording with the regulator, because requirements and dates change. Even where no rule applies, aligning with these expectations is a sensible benchmark.
Include supplier failure in your exercises. A scenario in which your key provider is unavailable for a week reveals hidden dependencies and slow decisions. See the guide to scenario planning for how to design the session.
Where possible, involve the supplier in the exercise so both sides understand roles.
Your supplier may rely on the same cloud platform, carrier or component maker as several of your other suppliers. When that shared upstream party fails, several of your services fail together, which is concentration risk. Ask critical suppliers to name their own key dependencies and locations, and look for overlaps across your portfolio. Where overlaps exist, consider diversifying at your level or asking suppliers to do so.
Also watch geographic concentration, since a single region can be exposed to the same weather, power grid or political event.
Procurement, business owners and incident responders all need to know what to do when a supplier fails. Brief them on the dependency map, the alternates, the contact lists and the decision rights. A short annual session, combined with a tabletop exercise, keeps knowledge fresh and reveals where guidance is missing. New starters in procurement should receive the same briefing so supplier onboarding includes continuity checks from the start.
Supplier risk changes. Track financial health, incident notices, ownership changes, audit findings and delivery performance. Set thresholds that trigger a review, as explained in our guide to continuity risk monitoring.
Imagine a single provider hosts your customer portal and its region suffers a prolonged outage. Customers cannot log in, and support calls rise sharply. The dependency map shows no alternate host, and the contract promises recovery within twelve hours while your tolerance for the portal is four. The assessment records a gap, scores the risk high and proposes treatment: a warm standby in another region, quarterly failover tests and a contract change requiring notification within thirty minutes. Cost and lead time are estimated, leaders approve the plan and the risk is tracked until the standby passes a live test. The example shows how mapping, scoring and treatment fit together.
Avoid these frequent failings.
Enter supplier risks in the register with clear scenarios, such as loss of the sole cloud provider for three days. Score them using your risk criteria and decide on treatment. The guide to risk treatment covers options such as diversification, buffers and contract changes.
Free third-party risk assessment
How much risk does this vendor bring?
Tier the vendor, check the evidence, rate the risks from 30 third-party scenarios and choose controls referenced to ISO 27001, NIST CSF 2.0 and DORA. You get a tier, a heat map and the findings an auditor would raise, free.
Start the free vendor risk assessment → or View premium report sample
Improvement need not happen all at once. Start with the five most critical suppliers, assess them, close the largest gaps and test one scenario. Then extend the approach to the next tier. Progress made in small, documented steps is easier to fund, easier to defend to auditors and easier to sustain than a large programme that stalls.
Keep a file per critical supplier with the dependency, assessment results, contract terms, contacts and alternates. If you want a ready structure, the Business Continuity Risk Assessment Report and Workbook provides scoring and treatment fields that fit supplier scenarios. Keep one consistent record so gaps are easy to see.
It is the risk that failures at suppliers or their suppliers interrupt critical activities beyond acceptable limits.
At least to the second tier for critical items, and further where a single upstream source could stop an activity.
Continuity plans, recent test results, recovery objectives, subcontractor lists and incident history.
No. Focus on critical suppliers, where the cost of switching is justified by the impact of failure.
Critical suppliers at least annually and whenever an alert or change occurs.
September 30, 2026
