A city IT shop runs three 'critical' applications on one shared vendor platform, but the BIA scores each application as if it could fail alone. What shared-dependency gap should the risk manager flag?
Select an answer to reveal the explanation.
Short Explanation
Think of three storefronts sharing one power pole—if the pole falls, all three go dark together. Scoring each app as if it fails alone hides that correlated hit. Call out the shared vendor so leadership sees the real blast radius.
Full Explanation
Business impact analysis must capture shared upstream dependencies that create correlated failure modes. When multiple critical applications rely on one vendor platform, treating each app as an independent failure understates simultaneous impact and recovery demand. Documenting the shared dependency improves prioritization, contingency design, and vendor assurance discussions.