A business impact analysis shows that a critical claims-processing function depends on a single external data provider, and no alternative source has been arranged. What should the information security manager do?
Select an answer to reveal the explanation.
Short Explanation
Finding a single point of failure in your BIA is the whole point of doing one, so you can't just write it down and walk away. You plan around it: get continuity commitments from the supplier or line up a backup source. Shrugging because it's "their problem" is the trap; the outage would still be yours.
Full Explanation
A BIA identifies not only critical processes but the resources they depend on, including external suppliers. A critical function with a single supplier and no alternative is a continuity exposure, so the dependency must be carried into continuity planning. Options include contractual continuity and recovery commitments from the supplier, evidence that the supplier's own plans are tested, an alternate supplier or a manual workaround, chosen according to the function's recovery objectives and cost. Recording the dependency and taking no action defeats the purpose of the analysis; the organization cannot control the supplier, but it can control how it prepares for the supplier's failure. Lowering the function's criticality because a third party is involved confuses dependency with importance; the business impact of losing claims processing is unchanged by who supplies its inputs. Caching a full copy of the provider's data is a technical idea that may be impractical, may breach licensing terms and cannot keep data current, so it does not provide continuity for an unlimited period. Exam caveat: fourth-party dependencies, such as the supplier's own hosting provider, may need the same attention. Operational check: confirm each critical supplier in the BIA has a documented continuity arrangement that meets the process's recovery time objective.