The primary goal of a business continuity strategy for suppliers is to ensure the resilience of the supply chain. This is achieved by making certain that the recovery capabilities of critical suppliers are synchronized with the recovery needs of the organization. The Recovery Time Objective (RTO) defines the maximum tolerable downtime for a specific business activity. If an activity depends on a supplier, that supplier must be able to resume providing the necessary product or service within the activity's RTO. Failure to ensure this alignment would make the organization's own recovery plans unachievable, regardless of other supplier attributes.

B. This is a standard 'business as usual' (BAU) procurement and quality management requirement, not a specific consideration for continuity and resilience during a disruption.
C. While procurement review is a valid governance step, it is a procedural control, not the core strategic objective that the Business Continuity professional must ensure is met.
D. Prioritizing existing suppliers without a thorough resilience assessment can perpetuate risk, such as single points of failure. A sound strategy evaluates all options, including diversification.

1. Business Continuity Institute (BCI)

Good Practice Guidelines (GPG)

2018 Edition. Professional Practice 4 (PP4): Design

Section 4.5.4 Supply Chain Strategy

emphasizes that strategies must be developed for the continuity of the supply chain. It states

"The BIA will have identified the RTO for each activity and the organization needs to understand the ability of its suppliers to meet these requirements." This directly supports aligning supplier capability with organizational RTOs.

2. ISO 22318:2015

Societal security — Business continuity management systems — Guidelines for supply chain continuity. Clause 6.3

"Determining and selecting supply chain continuity strategy and solutions

" outlines that the selection of strategies should be based on enabling the organization to meet its business continuity objectives (which are informed by RTOs) for product and service delivery.

3. ISO 22301:2019

Security and resilience — Business continuity management systems — Requirements. Clause 8.3.3

"Selection of business continuity strategies and solutions

" requires that strategies be selected to meet the requirements for resuming and recovering prioritized activities within their identified RTOs. This principle applies directly to activities that are dependent on suppliers.