Sanitation routing depends on a single SaaS vendor with no contracted alternate. What should the business impact analysis explicitly surface for continuity planning?

A business impact analysis must capture external dependencies that enable critical municipal processes, including single SaaS platforms that drive sanitation routing. When trash-truck routing hinges on one vendor with no contracted alternate path, that concentration risk is a continuity requirement input: it affects recovery time feasibility, workaround design, and contractual control expectations. Assuming cloud providers never fail, or that SaaS continuity risk belongs solely to the vendor, leaves the city blind to a single point of failure that can halt field operations even when internal data centers are healthy. Deleting the contract and rebuilding in-house before any BIA is a strategy choice that should follow impact and cost analysis, not a prerequisite that blocks documenting the dependency. Limiting the BIA to on-premises servers alone excludes modern process realities and understates operational exposure. Exam caveat: outsourcing processing does not outsource accountability for continuity; CISSP frames third-party and supply dependencies as part of assessing and prioritizing business continuity requirements. Operational check: inventory critical SaaS and API dependencies in the BIA, record concentration risk and absence of alternates, define manual or secondary routing workarounds, and negotiate SLAs, exit clauses, and escrow or export rights proportionate to impact. Test failover or degraded-mode collection routes before storm season so documented dependency risk becomes a treated control, not a surprise on collection day.