Insights · Field note · Infrastructure and resilience
Vendor outages and your continuity plan
Your plan recovers your systems. The outage is at your cloud provider, your payment processor or your identity service, and the plan has no page for that.
Most continuity plans assume the disruption is internal. Increasingly it is a vendor: a cloud region, an identity provider, a payment processor, a communications platform, a software-as-a-service application the business cannot work without. The plan has to treat consequential vendors as dependencies with their own scenarios: what the organization does during the outage, for how long it can continue, what workaround exists, how it learns of the outage, what the vendor has committed to, and when to activate an alternative. Vendor continuity commitments are assessed and recorded in the vendor register, and the scenarios are exercised, because an outage at a vendor is an outage at the organization.
In detail
What the evidence shows.
Which vendors
The ones whose outage stops a critical process: identity, cloud, payments, communications, scheduling, core applications. The dependency map and the impact analysis identify them. Each gets a scenario in the plan and a continuity assessment in the vendor register.
The scenario
Detection: how the organization learns of the outage, since the vendor’s status page is often the last to update. Duration tolerance: how long the process can wait. Workaround: manual procedures, cached data, alternate channels. Communication: what customers and staff are told. Activation: when to switch to an alternative, if one exists.
Vendor commitments
Service levels, recovery objectives, status communication, credits and exit terms, read and recorded before the outage. A vendor whose commitments do not meet the organization’s tolerance is a risk decision: accept, mitigate with a workaround, or replace.
Exercise it
A tabletop where the inject is a vendor outage reveals who notices, who decides and what the workaround actually is. See business continuity planning, infrastructure dependencies you did not know you had and third-party risk reviews.
Sources
Primary references.
- ISO 22301:2019, Security and resilience, business continuity management systems, requirements (ISO)
- NIST SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems
- Performance Data engagement observations (first-hand: David Selakovic); method described under Infrastructure Resilience.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days