Certified Information Security Manager (CISM)Incident ManagementHard
A CISO is developing a business continuity plan (BCP) for an organization that relies heavily on a single, highly specialized vendor for a critical component of its supply chain. The CISO identifies the potential for this vendor's failure to cause significant business disruption. Which of the following is the MOST effective strategy to mitigate this single point of failure in the BCP?
- AIncreasing the inventory of the critical component to buffer against outages.
- BImplementing redundant internal systems that do not rely on the vendor.
- CDeveloping relationships with alternative, pre-qualified vendors for the component.
- DEstablishing a service level agreement (SLA) with the vendor for rapid recovery.
Show answer & explanationAnswer & explanation
Correct answer: C. Developing relationships with alternative, pre-qualified vendors for the component.
Developing relationships with alternative, pre-qualified vendors directly addresses the single point of failure by providing immediate options if the primary vendor fails. While other options offer some mitigation, having a ready substitute is the most robust BCP strategy against a sole-source vendor failure.
Why the other options are wrong
- A. Increasing inventory provides a short-term buffer but doesn't solve the long-term dependency or a prolonged vendor outage.
- B. Implementing redundant internal systems might not be feasible if the component itself is specialized and external.
- D. An SLA ensures rapid recovery *if* the vendor can recover, but doesn't mitigate a complete vendor failure.
Supply Chain Diversification
A business continuity strategy that involves sourcing critical components or services from multiple distinct vendors to reduce reliance on any single supplier.
- Mitigates risks associated with vendor failure or disruption.
- Requires pre-qualification and relationship building with alternative suppliers.
- Enhances organizational resilience against external dependencies.
Memory trick: Don't put all your eggs in one supplier's basket.