ISO 22318

Identify and map suppliers across tiers, including sub suppliers where they materially affect prioritized activities.

• Supplier inventory with tier classification
• Multi tier supply chain maps for critical products
• Records of sub supplier discovery

• Inventory limited to tier 1
• Maps outdated after sourcing changes
• No visibility of sub suppliers

Assess each supplier's criticality based on contribution to prioritized activities, substitutability, and concentration risk.

• Supplier criticality scoring methodology
• Criticality register
• Annual refresh records

• Criticality based on spend only
• Substitutability not assessed
• Concentration risk ignored

Analyse the nature and extent of dependency on each critical supplier, including services, data, geography, and personnel.

• Dependency map per critical supplier
• Geographic concentration analysis
• Key person and team dependency notes

• Dependency mapped only at service level
• Geography not analysed
• No view of supplier key personnel

Exercise supply chain continuity arrangements with suppliers to validate readiness and identify gaps.

• Annual joint exercise plan
• Exercise reports with supplier participation
• Lessons learned register

• No supplier participation in exercises
• Exercises desk based only
• Lessons not actioned

Establish a programme to manage supply chain continuity within the BCMS, with scope, objectives, and governance defined.

• Supply chain continuity programme document
• Scope including tiers covered
• Governance forum terms of reference

• Programme limited to tier 1 only
• No exec sponsor
• Scope excludes outsourced IT

Define the organization's risk appetite for supply chain disruption, aligned with overall risk appetite.

• Supply chain risk appetite statement
• Tolerance levels per category
• Board or committee approval

• Risk appetite generic and unmeasurable
• No supply chain specific tolerances
• Approval not refreshed

Business continuity policy. Control from ISO 22318 framework, domain: ISO 22318: BCM Program Management.

• exercise report
• supplier audit findings
• supply chain risk register
• supplier continuity assessment

• gaps in alternate source validation
• incomplete supplier mapping
• missing tier-2 visibility
• weak contractual continuity terms
• insufficient supplier exercises

BCM program scope and objectives. Control from ISO 22318 framework, domain: ISO 22318: BCM Program Management.

• supply chain risk register
• supplier continuity assessment
• alternate supplier list
• contract continuity clauses
• exercise report
• supplier audit findings

• gaps in alternate source validation
• incomplete supplier mapping
• missing tier-2 visibility
• weak contractual continuity terms

Resource allocation for BCM. Control from ISO 22318 framework, domain: ISO 22318: BCM Program Management.

• alternate supplier list
• contract continuity clauses
• exercise report

• incomplete supplier mapping
• missing tier-2 visibility
• weak contractual continuity terms
• insufficient supplier exercises

BCM roles and responsibilities. Control from ISO 22318 framework, domain: ISO 22318: BCM Program Management.

• supply chain risk register
• supplier continuity assessment
• alternate supplier list
• contract continuity clauses
• exercise report

• incomplete supplier mapping
• missing tier-2 visibility
• weak contractual continuity terms
• insufficient supplier exercises
• gaps in alternate source validation

Management commitment to BCM. Control from ISO 22318 framework, domain: ISO 22318: BCM Program Management.

• supply chain risk register
• supplier continuity assessment
• alternate supplier list
• contract continuity clauses
• exercise report

• incomplete supplier mapping
• missing tier-2 visibility
• weak contractual continuity terms
• insufficient supplier exercises

Exercise program development. Control from ISO 22318 framework, domain: ISO 22318: BCM Testing & Exercising.

• alternate supplier list
• contract continuity clauses
• exercise report
• supplier audit findings

• gaps in alternate source validation
• incomplete supplier mapping
• missing tier-2 visibility
• weak contractual continuity terms
• insufficient supplier exercises

Tabletop and simulation exercises. Control from ISO 22318 framework, domain: ISO 22318: BCM Testing & Exercising.

• alternate supplier list
• contract continuity clauses
• exercise report
• supplier audit findings
• supply chain risk register

• insufficient supplier exercises
• gaps in alternate source validation
• incomplete supplier mapping
• missing tier-2 visibility
• weak contractual continuity terms

Full-scale testing procedures. Control from ISO 22318 framework, domain: ISO 22318: BCM Testing & Exercising.

• exercise report
• supplier audit findings
• supply chain risk register
• supplier continuity assessment

• missing tier-2 visibility
• weak contractual continuity terms
• insufficient supplier exercises
• gaps in alternate source validation
• incomplete supplier mapping

Post-exercise review and improvement. Control from ISO 22318 framework, domain: ISO 22318: BCM Testing & Exercising.

• contract continuity clauses
• exercise report
• supplier audit findings

• insufficient supplier exercises
• gaps in alternate source validation
• incomplete supplier mapping

Plan maintenance and update. Control from ISO 22318 framework, domain: ISO 22318: BCM Testing & Exercising.

• exercise report
• supplier audit findings
• supply chain risk register

• incomplete supplier mapping
• missing tier-2 visibility
• weak contractual continuity terms
• insufficient supplier exercises
• gaps in alternate source validation

Continuity strategy development. Control from ISO 22318 framework, domain: ISO 22318: Business Continuity Strategy.

• supplier continuity assessment
• alternate supplier list
• contract continuity clauses

• weak contractual continuity terms
• insufficient supplier exercises
• gaps in alternate source validation

Recovery strategy for critical activities. Control from ISO 22318 framework, domain: ISO 22318: Business Continuity Strategy.

• supplier audit findings
• supply chain risk register
• supplier continuity assessment
• alternate supplier list
• contract continuity clauses
• exercise report

• insufficient supplier exercises
• gaps in alternate source validation
• incomplete supplier mapping
• missing tier-2 visibility
• weak contractual continuity terms

Alternate site and resource planning. Control from ISO 22318 framework, domain: ISO 22318: Business Continuity Strategy.

• contract continuity clauses
• exercise report
• supplier audit findings
• supply chain risk register
• supplier continuity assessment

• missing tier-2 visibility
• weak contractual continuity terms
• insufficient supplier exercises
• gaps in alternate source validation

Supply chain continuity. Control from ISO 22318 framework, domain: ISO 22318: Business Continuity Strategy.

• alternate supplier list
• contract continuity clauses
• exercise report

• incomplete supplier mapping
• missing tier-2 visibility
• weak contractual continuity terms
• insufficient supplier exercises

Communication strategy during disruption. Control from ISO 22318 framework, domain: ISO 22318: Business Continuity Strategy.

• supply chain risk register
• supplier continuity assessment
• alternate supplier list
• contract continuity clauses

• incomplete supplier mapping
• missing tier-2 visibility
• weak contractual continuity terms
• insufficient supplier exercises
• gaps in alternate source validation

Business impact analysis methodology. Control from ISO 22318 framework, domain: ISO 22318: Business Impact Analysis.

• alternate supplier list
• contract continuity clauses
• exercise report
• supplier audit findings

• missing tier-2 visibility
• weak contractual continuity terms
• insufficient supplier exercises
• gaps in alternate source validation
• incomplete supplier mapping

Critical activity identification. Control from ISO 22318 framework, domain: ISO 22318: Business Impact Analysis.

• contract continuity clauses
• exercise report
• supplier audit findings

• insufficient supplier exercises
• gaps in alternate source validation
• incomplete supplier mapping

Recovery time and point objectives. Control from ISO 22318 framework, domain: ISO 22318: Business Impact Analysis.

• supplier continuity assessment
• alternate supplier list
• contract continuity clauses
• exercise report
• supplier audit findings

• gaps in alternate source validation
• incomplete supplier mapping
• missing tier-2 visibility

Resource requirements assessment. Control from ISO 22318 framework, domain: ISO 22318: Business Impact Analysis.

• supplier audit findings
• supply chain risk register
• supplier continuity assessment

• weak contractual continuity terms
• insufficient supplier exercises
• gaps in alternate source validation

Interdependency mapping. Control from ISO 22318 framework, domain: ISO 22318: Business Impact Analysis.

• supply chain risk register
• supplier continuity assessment
• alternate supplier list
• contract continuity clauses
• exercise report

• insufficient supplier exercises
• gaps in alternate source validation
• incomplete supplier mapping
• missing tier-2 visibility

Apply continual improvement based on incidents, exercises, audits, and market change to mature the programme.

• Improvement action register
• Annual programme review report
• Market scan for supplier and threat changes

• Improvement actions overdue
• Programme review skipped
• No market scanning function

Monitor supplier continuity performance through KPIs, audits, and incident reviews.

• Supplier continuity KPI dashboard
• Audit reports
• Post incident review records

• KPIs limited to delivery on time
• Audits never executed
• Incidents reviewed only by procurement

Obtain or develop continuity plans covering critical suppliers and integrate them with the organization's response.

• Continuity plans from critical suppliers
• Plan integration map with internal response
• Validation review notes

• Supplier plans absent or generic
• Plans not integrated with internal incident response
• No validation of supplier plans

Define communication and coordination protocols with suppliers for incident detection, escalation, and joint response.

• Up to date supplier contact directory
• Escalation tree with named roles
• Joint communication and incident protocols

• Contacts outdated
• No 24x7 escalation route
• Communication relies on email only

Define continuity requirements for suppliers, including RTO, RPO, MBCO, and resilience capability expectations.

• Continuity requirements specification per critical supplier
• Contract clauses for continuity
• Onboarding checklist enforcing requirements

• Requirements absent from contracts
• RTO and RPO not flowed down
• Onboarding skips continuity review

Identify and address concentration risk and systemic risk where multiple suppliers share common dependencies.

• Concentration risk analysis (geographic, vendor, sub tier)
• Systemic risk register
• Mitigation plans with owners

• Concentration analysis at tier 1 only
• Common cloud or carrier dependencies ignored
• No mitigation for systemic risks

Conduct due diligence on supplier continuity capability prior to selection and at defined intervals thereafter.

• Due diligence procedure
• Completed supplier assessments
• Re assessment schedule and records

• Due diligence done once only
• Assessments rely on supplier self attestation
• No re assessment cadence

Develop and document strategies to maintain or recover supply during disruption, including alternative sources, stockpiling, and process change.

• Strategy options register per critical supply
• Selection rationale and approval
• Cost and feasibility analysis

• Single strategy assumed without alternatives
• Stockpiling not considered
• Strategies not approved at exec level

Establish and maintain alternative supplier arrangements for critical supplies where feasible and proportionate.

• Alternative supplier register with status
• Standby or framework agreements
• Activation procedure with tested timelines

• Alternatives identified but not contracted
• Standby never tested
• Activation not defined

Use inventory, buffer stock, or pre positioned resources where appropriate to bridge supply disruption.

• Buffer stock policy
• Stock holding levels per critical SKU
• Periodic review of stock adequacy

• No buffer policy
• Stock levels not tied to MTPD
• Reviews not performed