Certified Information Security Manager (CISM)Incident ManagementHard
A CISO is developing a business continuity plan (BCP) for a critical supply chain that involves multiple third-party vendors. The CISO identifies that a disruption at a single key vendor could halt production. To enhance resilience and minimize the impact of such a disruption, which of the following strategies is MOST effective?
- AEstablishing a large inventory of critical components to buffer against short-term disruptions.
- BDiversifying the supply chain by engaging multiple vendors for critical components or services.
- CImplementing robust contractual agreements with penalties for vendor service disruptions.
- DRequiring all critical vendors to provide their own comprehensive BCPs for review.
Show answer & explanationAnswer & explanation
Correct answer: B. Diversifying the supply chain by engaging multiple vendors for critical components or services.
Diversifying the supply chain by engaging multiple vendors for critical components or services directly addresses the 'single point of failure' identified in the scenario. This strategy prevents a disruption at one vendor from completely halting production, offering inherent resilience and redundancy.
Why the other options are wrong
- A. A large inventory can buffer short-term disruptions but is expensive, finite, and does not address prolonged or systemic vendor failures.
- C. Contractual penalties provide financial recourse but do not prevent the operational disruption or ensure business continuity.
- D. Reviewing vendor BCPs is good due diligence but doesn't mitigate the inherent risk of reliance on a single vendor if their plan fails.
Supply Chain Diversification
The strategy of sourcing critical components, materials, or services from multiple independent vendors to reduce reliance on any single supplier.
- Mitigates single points of failure in the supply chain.
- Enhances resilience against vendor-specific disruptions.
- Can increase complexity in vendor management but improves continuity.
Memory trick: Don't put all your eggs in one supplier's basket.