ISO 22301:2019 · clauses 8.1 to 8.3
Your continuity plan helps little when the outage happens at a supplier.
The business continuity standard requires dependencies to be identified – and the most important ones sit outside the company. A business impact analysis without suppliers is incomplete.
ISO 22301 asks which activities must resume how quickly and what is needed for that. The required resources explicitly include partners and suppliers. Committing to a 24-hour recovery time means knowing whether the supplier of the critical component can carry it at all.
Two things usually break. The dependency list is incomplete because providers who deliver no goods are missing. And hidden concentration stays undetected because three suppliers use the same upstream source.
What gets missed
- Single sources without a qualified alternative – the most common continuity risk there is.
- Shared upstream suppliers behind apparently independent sources.
- IT providers whose outage halts operations faster than a missing delivery.
- Special tooling or moulds stored at a supplier.
What the standard requires
- 8.1
- Control outsourced processes; responsibility for continuity stays with the organisation.
- 8.2.2
- Identify all required resources in the business impact analysis, partners and suppliers included.
- 8.2.3
- Assess risks to prioritised activities – those from the supply chain too.
- 8.3
- Determine strategies and solutions: second source, buffer stock, relocation, agreements.
- 8.5
- Run exercises that include the failure of a critical supplier.
How SCRM covers it
Dependency graph
Upstream suppliers visible – hidden concentration surfaces before it bites.
Criticality by impact
Rated by consequence of failure and replaceability, not by order value.
Documented alternatives
A qualified alternative for every critical position instead of an assumption.
Contact routes
Emergency reachability recorded and confirmed on a schedule.
Frequently asked
How deep must dependency analysis go?
As deep as the recovery time demands. With a 24-hour commitment, tier one rarely suffices; for non-critical activities it does.
Is a second source on paper enough?
No. An unqualified alternative is not an alternative in an emergency. Approval belongs before the incident.
How does this relate to DORA and NIS2?
Both require resilience and exit capability for providers. A system run to 22301 supplies much of the groundwork.