risk
Critical vendor failure, insolvency or concentration
A key supplier, SaaS provider, or outsourced partner becomes insolvent, exits the market, or suffers a prolonged outage; sole-source and shared-tier concentration (multiple tier-1 vendors on a common tier-2) creates hidden single points of failure with no backup.
Record JSON · Open in map · Data retrieval guide
Catalog revision: 24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028. A connection does not establish full coverage.
Attributes
- category
- third_party
- domain
- Third-Party / Supply-Chain Risk
- Business Continuity & Disaster Recovery
- taxonomy
- enterprise-risk
- coso-erm-risk
- basel-operational-risk
- inherent_rating
- high
Details
- risk_id
- tprm-critical-vendor-failure
- category
- third_party
- likelihood
- medium
- impact
- high
- inherent_rating
- high
- treatment
- mitigate
- taxonomies
- enterprise-risk
- coso-erm-risk
- basel-operational-risk
Source
No record-specific source URL is provided.
Connections
- UC-TPRM-01 — Operate a third-party security risk management program mitigates Critical vendor failure, insolvency or concentration
- strength
- primary
- rationale
- Assessing criticality, substitutability, and concentration before contracting and maintaining tested exit strategies for critical providers is the core defense against vendor failure and concentration.
- UC-ACCESS-21 — Manage subservice organizations supporting the system mitigates Critical vendor failure, insolvency or concentration
- strength
- related
- rationale
- Monitoring critical subservice-org performance and assurance gives early warning of a deteriorating dependency, reducing failure impact.
- UC-TPRM-04 — Monitor vendor performance, services, and risk mitigates Critical vendor failure, insolvency or concentration
- strength
- related
- rationale
- Periodic reassessment and posture monitoring surface a deteriorating critical vendor early, reducing failure impact.
- UC-TPRM-02 — Perform risk-based due diligence before engaging vendors mitigates Critical vendor failure, insolvency or concentration
- strength
- primary
- rationale
- Evaluating financial and operational risk before engagement screens for insolvency and viability risk, directly reducing critical-vendor-failure likelihood.
- UC-TPRM-06 — Manage secure termination and disposal at relationship end mitigates Critical vendor failure, insolvency or concentration
- strength
- related
- rationale
- Data return, access revocation, and service-transition provisions enable clean exit and recovery when a critical vendor fails or exits.
- UC-TPRM-08 — Govern security of external and cloud service use mitigates Critical vendor failure, insolvency or concentration
- strength
- related
- rationale
- Agreeing exit terms for external and cloud services reduces lock-in and the impact of a cloud provider's failure or exit.
- UC-TPRM-05 — Include suppliers in incident notification and response mitigates Critical vendor failure, insolvency or concentration
- strength
- related
- rationale
- Including suppliers in incident response and recovery with pre-defined coordination reduces the impact of an incident-driven prolonged outage.