Establishing Third-Party Resilience Management Practices and Resilience Organisational Culture
What this domain tests
This domain tests whether you can govern third-party and fourth-party dependency risk and build a culture in which resilience is owned by the business, not delegated to a function.
Core rules
- Maintain a register of critical third parties mapped to IBS. Criticality depends on substitutability, concentration, access to data, and the tolerance breached if the provider fails.
- Due diligence precedes contracting; contracts should include availability, incident notification, testing rights, audit rights, data return, subcontracting controls, and termination assistance.
- Ongoing monitoring uses service-level evidence, incident data, financial and cyber posture, and concentration analysis, not just annual questionnaires.
- Exit plans must be viable: data portability, alternative providers, internal fallback, cost, and time. Test the plan or at least validate assumptions.
- Culture: leaders model speak-up behaviour, incidents are reported without blame, incentives reward early escalation, and training is role-specific.
Worked example
A payments firm relies on one cloud provider for its instant payments IBS. The provider is critical and concentration is high. The firm adds contractual notification and testing rights, builds a secondary region with an independent path, and tests data portability to an alternative environment. The exit plan is not a document; it is a validated sequence with named owners and time estimates.
Traps
- Equating a signed contract with resilience assurance.
- Monitoring only tier-one suppliers while ignoring subcontractors.
- Writing an exit plan that has never been costed or rehearsed.
- Treating culture as posters and training completion.
- Punishing incident reporters, which suppresses early warning.
- Letting procurement own third-party risk without business service accountability.