If a critical supplier is unavailable, can the service continue?

Start

A supplier a critical service depends on is unavailable

A critical supplier is one that runs or supports a critical service, such as a hosting, ERP or network provider. Whether the service carries on depends on choices made long before the outage: a second route, recovery targets in the contract, and names in the plans. This flow uses those choices, and shows where they were missing.

• Then: Reach the supplier's named contact and ask when it will recover

Step

Reach the supplier's named contact and ask when it will recover

The pack's policy requires every Tier 1 supplier to be in your incident response and continuity plans, with named contacts and notification duties. The cooperation clause asks the supplier to name a security contact in the contract. Ask for the cause, the services affected and a recovery estimate, in writing.

• Then: Is this supplier in your continuity and incident plans?

Decision

Is this supplier in your continuity and incident plans?

Look for the supplier by name, with its contacts and what the plan does if it fails. A generic line such as 'IT supplier outage' does not count. If you cannot find it quickly, answer no.

• Yes: Follow the plan's arrangements for this supplier
• No, or not known: Work from the supplier register and the contract

Step

Follow the plan's arrangements for this supplier

Use the contacts, workarounds and decisions the plan already sets. The plan was written when there was time to think. Deviate only for a reason you record.

• Then: Do other critical services depend on the same provider?

Step

Work from the supplier register and the contract

The supplier register should show which critical services this supplier supports, and the contract should name the contacts and recovery targets. Use them now. Note the gap in the plans: it is corrected after the event.

• Then: Do other critical services depend on the same provider?

Decision

Do other critical services depend on the same provider?

A provider that two or more critical services depend on can stop several at once. Look beyond the supplier you called: several suppliers may run on the same cloud platform or software. If you don't know, answer yes.

• Yes, or not known: Treat it as one event across every affected service
• No: Can another supplier or an in-house route carry the service?

Step

Treat it as one event across every affected service

Bring the owners of every affected critical service into the same response, so that people and workarounds are shared and not competed for. In the pack's example, one managed IT provider supports three critical services; its outage would touch all three at once.

• Then: Can another supplier or an in-house route carry the service?

Decision

Can another supplier or an in-house route carry the service?

In the pack's example, the pallet network fails but two parcel carriers keep parcels moving, so the harm stays moderate. The substitutability answer you gave when tiering the supplier should tell you whether such a route exists. If you have not tested it, answer not known.

• Yes: Move the work to the alternative and watch its limits
• No, or not known: Will it be back before the service can bear no more?

Step

Move the work to the alternative and watch its limits

An alternative carries the service only as far as its capacity, and the data and access it has. Check both as you switch. Keep the switch within the contract and data terms you already hold with the alternative supplier.

• Then: Was the outage caused by a security incident?

Decision

Will it be back before the service can bear no more?

Compare the supplier's estimate, and the recovery time in its contract, with the longest outage your service can bear. The pack's clause puts it plainly: a supplier recovering in 72 hours cannot support a service you need back in 24. If the supplier gives no estimate, answer no.

• Yes: Run degraded, and hold the supplier to its recovery targets
• No, or not known: Invoke your continuity plan and tell executive management

Step

Run degraded, and hold the supplier to its recovery targets

Keep the service owner and the supplier's contact in step until the service is back. Record the times: they show whether the supplier met its contract, and they feed the review after the event.

• Then: Was the outage caused by a security incident?

Step

Invoke your continuity plan and tell executive management

When no route is left and recovery will come too late, the service stops. Who invokes the continuity plan is set by that plan, not by this pack. Tell executive management, which in the pack decides on supplier risks escalated to it. The pack does not set the recovery steps; your continuity plan does.

• Then: Was the outage caused by a security incident?

Decision

Was the outage caused by a security incident?

The pack's incident clause counts anything that compromises the availability of the services as a security incident, so ask the supplier. If it cannot yet say, answer not known.

• Yes, or not known: Handle it as a supplier incident as well
• No: Start a triggered reassessment of the supplier

Step

Handle it as a supplier incident as well

Hold the supplier to its notification duty, ask for evidence under the cooperation clause, and run it under your incident response plan. Your own duties to notify regulators or customers may apply.

• Then: Start a triggered reassessment of the supplier

Step

Start a triggered reassessment of the supplier

A security incident or breach at a supplier is a pack trigger for reassessment, starting again at tiering because the tier may change; the pack's default is to start within 10 working days of learning of it. An outage with no security cause is not on that list, but it may show a substitutability answer or recovery target was wrong, so reassessing is then your judgement. Update the residual risk with what the outage showed.

• Then: Did it show the supplier cannot support the service?

Decision

Did it show the supplier cannot support the service?

Missed recovery targets, a second route that did not work, or a service stopped longer than it can bear all say yes. So does an answer to the substitutability question that proved untrue.

• Yes, or not known: Take the supplier decision to the business owner
• No: Correct the plans, the exit plan and the register

Outcome

Take the supplier decision to the business owner

The business owner decides on the reassessment: fix the gaps as conditions, escalate the risk into the risk register, or reject and run the exit plan. The pack's termination clause lets you leave without penalty after a security incident that causes you material harm. In the pack, rejecting or exiting a Tier 1 supplier is decided by the board, or a board risk committee it has delegated this to; the management board in a two-tier structure; executive management where there is no board.

Outcome

Correct the plans, the exit plan and the register

Put what you learned into the continuity and incident plans: names, workarounds, real recovery times. Check the exit plan and the substitutability answer against what happened. Record the event in your supplier register. If the provider supports several critical services, check the concentration list you report each quarter still holds.