Supplier and third-party resilience

A business continuity plan that only looks inward misses a common real-world cause of disruption: a critical supplier failing, whether that's a software provider having an outage, a payment processor going down, or a physical supplier unable to deliver.

What to consider

• Which suppliers, if they failed or became unavailable, would stop a critical business function.
• Whether there's a realistic alternative, or a contractual protection, for each of those single points of failure.
• Whether the risk assessment in the previous section has actually captured supplier dependency as its own category, not just internal IT and facilities.

A resilient organisation with a single point of failure sitting entirely outside its own control, and no plan for it, isn't actually resilient.