Supplier Business Continuity Assessment Template

Supplier continuity assessment should answer a practical question: if this provider fails during a severe but plausible disruption, can our important service still remain within its approved recovery requirement? A generic questionnaire with 50 “yes” answers is weak evidence if it never tests the specific service, locations, subcontractors, technology or concentration on which you depend.

Critical supplier tiering

50-question supplier continuity assessment

Service and dependency

1. What exact service/product do you provide to us?
2. Which of our business services depend on it?
3. Which locations/data centres/cloud regions deliver it?
4. What operating hours and peak capacity are supported?
5. Which parts are subcontracted?
6. Which utilities/telecom/cloud platforms are material dependencies?
7. Can one event affect multiple locations?
8. What customer-specific configuration or data is needed to recover?

Governance and plans

9. Is there an approved continuity policy?
10. Who is accountable for continuity?
11. When was the service BIA last reviewed?
12. What recovery objectives are approved?
13. Does the plan cover people, technology, facilities and suppliers?
14. What triggers plan activation?
15. Who may declare a disaster/failover?
16. How often are plans reviewed after change?

Technology and data

17. What RTO/RPO commitment applies to our service?
18. What recovery architecture supports it?
19. Are backup/restoration procedures tested?
20. How is backup isolation/immutability handled where relevant?
21. How are identity/DNS/network dependencies recovered?
22. How are transactions reconciled after recovery?
23. How is cyber clean recovery handled?
24. What is the last demonstrated recovery time and recovery point?

People and location

25. What minimum staffing is needed?
26. Are alternates cross-trained?
27. Can service operate remotely or from another site?
28. Are both primary and alternate teams exposed to the same regional event?
29. What specialist or privileged roles are single points of failure?
30. What absenteeism assumption has been tested?

Exercises and incidents

31. When was the service last exercised?
32. Was the exercise technical, business or integrated?
33. What scenario was used?
34. Were customers invited or evidence shared?
35. Which material findings remain open?
36. Have actual incidents exceeded recovery targets?
37. How are lessons learned tracked?
38. Can we participate in a joint scenario test?

Contract, communication and exit

39. What emergency support route and escalation contacts exist?
40. What incident-notification commitment exists?
41. What information is provided during disruption?
42. Are resilience obligations flowed to material subcontractors?
43. What audit/assurance rights exist?
44. What service credits/remedies apply and do they actually reduce continuity risk?
45. What data-return/deletion obligations apply on exit?
46. How long would transition to an alternate take?

Concentration and resilience

47. Which other critical suppliers share the same underlying cloud/telecom/data centre?
48. Is there geographic/provider concentration?
49. Can primary and DR capacity be exhausted by multiple customers at once?
50. Is recovery capacity reserved or best effort?
51. What dependency cannot currently meet our target?
52. What compensating controls exist?
53. What change would force immediate reassessment?
54. Who in our organisation owns the residual supplier risk?

Requirement-to-evidence matrix

Contract clauses BCM should discuss with procurement/legal

• Service and recovery objectives defined in measurable terms.
• Incident notification and update expectations appropriate to the dependency.
• Participation in exercises or provision of meaningful test evidence.
• Subcontractor and material-change notification where appropriate.
• Access to continuity/assurance evidence and corrective-action status.
• Data availability, backup, restoration, return and secure deletion responsibilities.
• Exit assistance, transition period, format and portability.
• Emergency escalation contacts and authority.
• Location/jurisdiction/concentration information where relevant to risk.
• No contract clause replaces the organisation’s own contingency strategy.

Official references and further reading

• Basel operational resilience principles — Banking-sector principles include third-party dependency management as part of operational resilience.
• FCA operational resilience mapping — For in-scope UK firms, mapping includes third parties supporting important business services.
• DORA summary — EU financial-sector rules include ICT third-party risk management for in-scope entities.

Critical supplier evidence matrix

Supplier concentration analysis

Assess concentration across more than supplier names. Ten vendors can still depend on the same cloud region, telecom carrier, identity provider, logistics hub, software component or specialist workforce. Create a concentration view that maps critical services to fourth parties, locations, infrastructure and common technology. Then exercise a common-mode scenario rather than one vendor at a time.

Contract and SLA questions for BCM

• Does the contract define recovery commitments for the exact service you consume?
• Does the SLA begin at incident start, provider declaration or customer ticket creation?
• Are RTO/RPO commitments accompanied by test evidence rights?
• Can you participate in or receive results from relevant resilience exercises?
• Are subcontractor changes and material location changes notified?
• Is incident notification fast enough for your own regulatory/customer obligations?
• Is data export available during distress/termination, and how long does it take?
• What capacity is guaranteed when a regional event affects multiple customers?
• Are cyber recovery, data integrity and credential rotation addressed?
• Does the exit plan work if the provider is unavailable rather than cooperative?