Supplier continuity begins with service dependency, not a questionnaire
A long vendor questionnaire does not tell you whether a critical service can survive supplier disruption. Start by identifying which products, services and processes depend on each supplier, what minimum capability is required, how quickly it is needed and whether a realistic substitute exists. This creates a criticality tier that determines the depth of assurance.
Tier suppliers by consequence and substitutability
Consider time to unacceptable impact, switching time, data and integration complexity, geographic concentration, fourth parties, inventory buffers, regulatory constraints and contractual leverage. A supplier that is easy to replace in thirty days may require less assurance than a low-spend SaaS provider whose identity service is needed within one hour.
| Lifecycle stage | Evidence | Decision |
|---|---|---|
| Onboarding | criticality assessment, dependencies, recovery claims | approve, conditionally approve or reject |
| Contracting | recovery targets, notification, testing, data access, exit support | make obligations enforceable |
| Operation | incidents, SLA trends, changes, assurance reports | continue, remediate or escalate |
| Exercise | joint scenario, failover or evidence review | validate claimed capability |
| Exit | data return, alternate supplier, transition plan | reduce lock-in and residual dependency |
Contract for outcomes that matter
Where proportionate, contracts should address incident notification, continuity contacts, recovery objectives, minimum service, test participation, material architecture changes, subcontractor dependencies, data portability and termination/transition assistance. Avoid clauses that merely require the supplier to “have a BCP” without defining the service outcome the customer needs.
Scenario: concentrated cloud dependency
Three critical business services use different SaaS products, but all three rely on the same cloud region and identity provider. Individual vendor assessments rate each SaaS provider as low risk. An enterprise dependency view reveals a common-mode failure. The continuity treatment therefore includes alternate authentication procedures, prioritized degraded services, cross-region evidence where available and a management decision on residual concentration risk.
Supplier review checklist
- link supplier to consuming services and process owners
- record required recovery time, data loss and minimum capacity
- identify subcontractors and common technology/geographic dependencies
- verify evidence rather than accepting policy statements only
- define incident notification and escalation contacts
- test the customer-supplier handoff and degraded-service assumptions
- maintain exit, substitution and data-portability options
- track findings, exceptions and accepted residual risk
Due diligence that tests the consumed service
Request evidence relevant to the service you buy: recovery architecture, latest meaningful test, recovery result, known exceptions, dependency model, incident communication process and continuity contacts. A corporate continuity policy may demonstrate governance but says little about the recovery of a specific hosted platform, logistics lane or manufacturing component. Where evidence cannot be shared for security reasons, use an attestation, independent assurance report or structured review with explicit residual uncertainty.
Compare supplier recovery claims with your own BIA. If the business requires four-hour restoration and the supplier commits only to best efforts within twenty-four hours, the gap exists regardless of questionnaire score. Treat it through alternate supply, inventory, degraded mode, architecture change, contractual negotiation or explicit risk acceptance.
Monitor change and prepare exit
Supplier resilience can deteriorate after onboarding. Monitor major incidents, SLA deterioration, acquisitions, data-center moves, platform migrations, subcontractor changes and financial stress where appropriate. Define notification triggers in governance and contract language. For high-criticality services, maintain an exit playbook covering data export, configuration transfer, knowledge transfer, alternate provider lead time, regulatory approvals and the period during which both providers may need to operate in parallel.
Practitioner FAQ
Should every supplier provide ISO 22301 certification?
No. Assurance should be proportionate to criticality and context. Certification may be useful evidence, but it does not by itself prove that the specific service you consume can meet your recovery needs.
How often should critical suppliers be reviewed?
Use a risk-based cadence and trigger event-driven reviews after major incidents, architecture changes, ownership changes, material subcontractor changes or significant deterioration in service.
What is the biggest hidden supplier risk?
Concentration and fourth-party dependency are frequent blind spots because individually acceptable suppliers can rely on the same cloud, telecom, logistics, identity or geographic dependency.
Define supplier recovery requirements before contracting
Translate the consuming service’s tolerance into supplier expectations: minimum capacity, restoration time, data recovery, communication, alternate delivery, subcontractor controls and evidence rights. Generic wording that a supplier “maintains a BCP” does not show whether the contracted service can support your recovery requirement.
Validate evidence proportionately
For the most critical suppliers, combine document review with service-specific questions, recovery-test evidence and scenario discussion. Certification can support assurance, but it does not prove that your particular service, region, integration or capacity is covered. Lower-tier suppliers can use lighter evidence so effort is focused where disruption would matter most.
Monitor concentration and fourth-party risk
Several suppliers may depend on the same cloud provider, telecommunications carrier, logistics hub or specialist subcontractor. Record these shared dependencies and include them in scenario testing. Apparent supplier diversity can disappear during a regional or systemic outage.
Prepare an executable exit path
For critical services, document data extraction, intellectual-property access, transition support, alternate supplier lead time, internal skills and minimum bridging arrangements. Test selected exit assumptions before a crisis. A substitution strategy that requires six months of integration is not a credible response to a supplier that must be replaced within days.
Supplier incident communication
Agree who the supplier must contact, how quickly material disruption is reported, what information is required in each update and how escalation works outside normal business hours. During exercises, test the communication path as well as the technical recovery. Delayed or incomplete supplier information can prevent your own crisis team from making timely decisions.
Supplier assurance decision record
For each critical supplier, keep a short decision record that links the supported service to dependency strength, tolerated outage, substitution lead time, concentration risk and the evidence reviewed. Do not treat a certificate or questionnaire as proof of recoverability. Ask for evidence that matches the dependency: tested alternate capacity, recovery test results, named subcontractor dependencies, notification commitments and restoration priorities. Where evidence is weak, document compensating controls such as dual sourcing, safety stock, manual workarounds or contractual improvement actions, with an owner and due date.
Supplier continuity evidence beyond questionnaires
A supplier questionnaire is only an initial signal. For a dependency that can stop a critical service, request evidence proportionate to the exposure: recovery objectives, alternate delivery arrangements, recent exercise results, concentration risks, subcontractor dependencies, incident notification commitments and named escalation contacts. Compare the supplier commitment with the consuming process RTO rather than scoring the supplier in isolation. If a process must recover in four hours but its sole supplier commits to twenty-four, the risk is structural and should trigger an alternate source, inventory buffer, redesigned process or formally accepted exception. Periodically test contact routes and at least one realistic disruption scenario with strategic suppliers. Record the outcome as evidence for procurement, risk and continuity governance.