Has your organization established a business continuity plan that specifically addresses supplier and supply chain interruptions?
Explanation
A business continuity plan for supply chain disruptions helps organizations maintain critical operations during unexpected supplier issues such as vendor bankruptcy, natural disasters affecting suppliers, geopolitical conflicts, or transportation disruptions. This plan should identify critical suppliers, alternative sourcing options, inventory management strategies, and communication protocols for supply chain emergencies.
Evidence could include a documented business continuity plan with specific sections addressing supply chain risks, supplier contingency arrangements, emergency contact lists for key vendors, and records of supply chain disruption simulations or tabletop exercises.
Implementation Example
Plan for unexpected supplier and supply chain-related interruptions to ensure business continuity
ID: GV.SC-07.102
Context
- Function
- GV: GOVERN
- Category
- GV.SC: Cybersecurity Supply Chain Risk Management
- Sub-Category
- The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship
Related questions
- Has your organization established a documented strategy that defines the objectives of your cybersecurity supply chain risk management program?
- Has your organization developed a formal cybersecurity supply chain risk management program with documented policies, procedures, and an implementation plan with milestones that is shared with relevant stakeholders?
- Has your organization developed and implemented the processes from the cybersecurity supply chain risk management program, that align with your security strategy, objectives, policies, and procedures with documented stakeholder agreement and participation?
- Has your organization established a formal cross-functional team or committee responsible for cybersecurity supply chain risk management?
- Has your organization formally designated specific roles or positions responsible for cybersecurity supply chain risk management activities?
- Has your organization documented cybersecurity supply chain risk management roles and responsibilities in a formal policy?