Supply Chain, Third-Party, and Cloud Resilience
Resilience does not stop at your perimeter
The exam tests whether you can manage dependence on suppliers, cloud providers, and fourth parties. Outsourcing does not outsource accountability. A resilient third-party program combines due diligence, contract terms, continuous monitoring, and exit planning. Cloud resilience depends on the shared responsibility model: the provider secures the cloud infrastructure, while the customer secures identities, configurations, data, and usage.
Core rules
- Tier vendors by business criticality and data sensitivity. Due diligence should cover security controls, incident history, financial viability, concentration risk, and subcontractors.
- Contracts need measurable RTO/RPO commitments, breach notification timelines, audit or assurance rights, data location, data return and deletion, subcontractor approval, and termination assistance.
- Monitor continuously through questionnaires, certifications such as SOC 2 or ISO 27001, vulnerability disclosures, and service-level reporting. A certificate is a point-in-time opinion, not a guarantee.
- Map fourth parties and concentration risk: one identity provider, one cloud region, one backup vendor, or one logistics provider can be a single point of failure.
- For cloud, verify region and availability-zone design, backup of SaaS data, key management, identity integration, and exit routes. Provider backups may not cover customer data corruption or deletion.
Worked example
A company relies on a SaaS CRM with a contractual RTO of four hours. The provider suffers a regional outage and cannot meet it. The customer has daily data exports with a 24-hour RPO and a manual sales-intake process for 48 hours. The BIA shows the manual process is acceptable for two days, so the residual risk is accepted. The contract is renegotiated to require cross-region failover and a 12-hour notification. The lesson: the provider's RTO is not the customer's recovery capability unless the customer has validated it.
Traps
Do not assume cloud means automatic backup or DR. Do not accept a certification as proof of resilience. Do not ignore subcontractors and fourth parties. Do not sign contracts without notification, data return, and exit terms. Do not let vendor RTOs exceed your own MTD.