If a critical supplier's recovery time is longer than our service can wait, then what do we do?

Start

A supplier may recover slower than a critical service can wait

A service cannot recover faster than the supplier that runs part of it. Where the contract gives no recovery time, nobody knows how long the organisation will wait. This flow is for planning, before an outage; if the supplier is down now, use the continuity plan first.

• Then: List every critical service it runs a system for

Step

List every critical service it runs a system for

Take them from your dependency register. The time the supplier must meet is the shortest RTO among the services it supports, and a supplier several services share stops them all at once. In the pack's example, the network provider serves online ordering, with 24 hours, and dispatch, with 8: it must meet 8.

• Then: Does its contract give a recovery time for what you buy?

Decision

Does its contract give a recovery time for what you buy?

Look for a time to restore the service, not an availability figure. A contract that sets availability does not say how long a recovery takes. If you cannot find the time, take the cautious branch.

• Yes: Is it no longer than the shortest RTO it serves?
• No, or not known: Record it as Not known, a gap, and plan as if it were too long

Step

Record it as Not known, a gap, and plan as if it were too long

A supplier time that is not known fails the check as surely as one that is too long. Record the gap with an owner and a due date, and tell the service's risk owner. Ask the supplier what it commits to, whether it has tested it, and what it would restore first after ransomware. Raise it at the supplier's next assessment, as the pack's example does for its backup service provider.

• Then: The business owner records the workaround and who starts it

Decision

Is it no longer than the shortest RTO it serves?

Compare the contracted time with the shortest RTO among the services the supplier supports. A tested time is better evidence than a contract alone: ask for the supplier's last test result.

• Yes: Name it in the plan with a 24/7 contact and its notice
• No: Record the gap against the RTO it misses

Outcome

Name it in the plan with a 24/7 contact and its notice

Critical suppliers must be part of incident response and continuity plans, with named contacts and notification duties. Put the contracted time, a contact not reached through your own email, and the notice it must give in the service's plan. Check it again when the contract or the service's objectives change.

Step

Record the gap against the RTO it misses

A contracted time longer than the RTO fails two checks: the supplier time (MX-04) and the dependency's recovery in time (MX-02). Record one gap with both, an owner and a due date; the owner agrees the change within 10 working days, the pack's default, and the risk owner reassesses the risk. In the pack's example, a failed network line is restored within 12 hours, and dispatch needs 8.

• Then: The business owner records the workaround and who starts it

Step

The business owner records the workaround and who starts it

Where a service cannot be back within its recovery time, its business owner records a workaround that keeps the harm below Severe until the service returns, how long it can run, and who starts it. Check that it does not itself depend on the same supplier. One never tried is recorded as untried. The workaround carries the gap; it does not close it.

• Then: Would the supplier be back within the service's MTD?

Decision

Would the supplier be back within the service's MTD?

Between the RTO and the MTD, the service misses its target but the harm stays below Severe. Beyond the MTD, the harm reaches Severe unless the workaround holds until the supplier is back. A time that is not known takes the cautious branch.

• Yes: Seek a shorter recovery time through the contract's recovery clause
• No, or not known: Can the workaround run until the supplier is back?

Decision

Can the workaround run until the supplier is back?

The plan records how long the workaround can run before harm reaches Severe, such as invoicing business customers on account while a payment provider is down. Compare that with the supplier's time. If there is no workaround, it has never been tried, or nobody knows how long it lasts, take the cautious branch.

• Yes: Seek a shorter recovery time through the contract's recovery clause
• No, or not known: Tell the owners the service would reach Severe harm

Step

Tell the owners the service would reach Severe harm

On these facts the service cannot recover in time. Tell the business owner and the service's risk owner by name: the risk is reassessed on the ground that a supplier outage alone would take the service past its maximum. Look for any partial workaround that slows the harm while the gap is closed.

• Then: Seek a shorter recovery time through the contract's recovery clause

Step

Seek a shorter recovery time through the contract's recovery clause

The recovery clause commits the supplier to plans, recovery targets and tests that match how long your services can be without it. The clause's defaults: a recovery time and data loss in hours, a test at least every year, a summary of each test within 30 days, and taking part in your own tests. A supplier recovering in 72 hours cannot support a service you need back in 24.

• Then: Will the supplier commit to a time within the RTO?

Decision

Will the supplier commit to a time within the RTO?

Raise it at the supplier's next assessment, as the pack's example does, or at renewal if that comes sooner. Accept the supplier's own wording if it achieves the same outcome. A promise outside the contract is not a commitment: take the cautious branch.

• Yes: Put the time in the contract, the register and the plan
• No, or not known: Can another provider or route meet the RTO at an accepted cost?

Outcome

Put the time in the contract, the register and the plan

Record the contracted time in the dependency register and the service's plan, with the supplier's contact and notice, and close the gap once its checks pass. Ask for the supplier's test results each year, and include the supplier in your own recovery test of the service.

Decision

Can another provider or route meet the RTO at an accepted cost?

An alternative may be a second supplier, such as a second network line from another provider, another site, or a workaround that meets the RTO. It counts only once it would work today. Weigh its cost against the harm the impact analysis showed. If none is available or affordable, take the cautious branch.

• Yes: Put the alternative in place and record it in the register
• No, or not known: The risk owner decides: treat, accept at the right level, or exit

Outcome

Put the alternative in place and record it in the register

Give the change an owner and a due date, record the alternative against the dependency and mark it in place only when it would work today. Add its own recovery time and contact to the plan, and test the switch in the service's next recovery test.

Outcome

The risk owner decides: treat, accept at the right level, or exit

Accepting the risk is recorded and approved at the level its rating sets; outside tolerance only the board or its equivalent may accept: the board, or a board risk committee it has delegated to; the management board in a two-tier structure; executive management where there is no board. A recovery clause the supplier would not sign is recorded as an exception under the supplier pack; the objective gap stays open in your matrix. Check the exit plan if leaving is the answer.