Has your organization identified, documented, and communicated external dependencies that could serve as potential points of failure for critical capabilities and services?

External dependencies such as third-party vendors, cloud service providers, utility services, or supply chain partners can create vulnerabilities that impact critical business operations. Identifying these dependencies helps organizations understand their complete risk landscape and develop appropriate contingency plans.

Evidence could include a documented dependency map or register that identifies critical external services, their potential impact on operations if disrupted, and contact information for key personnel. This document should be regularly reviewed and shared with relevant stakeholders responsible for business continuity and risk management.