{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"third_party","domain":["Third-Party / Supply-Chain Risk","Business Continuity & Disaster Recovery"],"inherent_rating":"high","taxonomy":["enterprise-risk","coso-erm-risk","basel-operational-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Atprm-critical-vendor-failure","description":"A key supplier, SaaS provider, or outsourced partner becomes insolvent, exits the market, or suffers a prolonged outage; sole-source and shared-tier concentration (multiple tier-1 vendors on a common tier-2) creates hidden single points of failure with no backup.","details":{"category":"third_party","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"tprm-critical-vendor-failure","taxonomies":["enterprise-risk","coso-erm-risk","basel-operational-risk"],"treatment":"mitigate"},"id":"risk:tprm-critical-vendor-failure","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Atprm-critical-vendor-failure","sourceIds":["cobit-2019","dora","iso-27001","nis2","nist-800-53","nist-csf-2","nydfs-500","soc1","soc2"],"sourceUrl":null,"title":"Critical vendor failure, insolvency or concentration","type":"risk"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:69a6c7f9bed48e02129fbab011819e3d8abc7f7cd2f0680cee3c0301c965118b","properties":{"rationale":"Assessing criticality, substitutability, and concentration before contracting and maintaining tested exit strategies for critical providers is the core defense against vendor failure and concentration.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-tprm-01-16b62053.json","sourceId":"uc:UC-TPRM-01","targetDetailPath":"/data/v1/records/risk-tprm-critical-vendor-failure-cb39c2bc.json","targetId":"risk:tprm-critical-vendor-failure","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8aa481877a788d7863fea791d7cbf6befa77c3757189e083d3cfb4460dfe706e","properties":{"rationale":"Monitoring critical subservice-org performance and assurance gives early warning of a deteriorating dependency, reducing failure impact.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-access-21-14f45683.json","sourceId":"uc:UC-ACCESS-21","targetDetailPath":"/data/v1/records/risk-tprm-critical-vendor-failure-cb39c2bc.json","targetId":"risk:tprm-critical-vendor-failure","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8b5339b55f3cfa07fa148380586286f6166a50636b410e705ccac8c513dd8971","properties":{"rationale":"Periodic reassessment and posture monitoring surface a deteriorating critical vendor early, reducing failure impact.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-tprm-04-e6aef252.json","sourceId":"uc:UC-TPRM-04","targetDetailPath":"/data/v1/records/risk-tprm-critical-vendor-failure-cb39c2bc.json","targetId":"risk:tprm-critical-vendor-failure","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8c220bfd2011cc9dcf6c061c3d3002827fdbc77836a8f7c2ab7418643ccc3e8a","properties":{"rationale":"Evaluating financial and operational risk before engagement screens for insolvency and viability risk, directly reducing critical-vendor-failure likelihood.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-tprm-02-c35b26eb.json","sourceId":"uc:UC-TPRM-02","targetDetailPath":"/data/v1/records/risk-tprm-critical-vendor-failure-cb39c2bc.json","targetId":"risk:tprm-critical-vendor-failure","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8e19fe83325fffd4d57205245a5ba46311539a1fb85eb8758096baf267795d72","properties":{"rationale":"Data return, access revocation, and service-transition provisions enable clean exit and recovery when a critical vendor fails or exits.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-tprm-06-0d2c1b90.json","sourceId":"uc:UC-TPRM-06","targetDetailPath":"/data/v1/records/risk-tprm-critical-vendor-failure-cb39c2bc.json","targetId":"risk:tprm-critical-vendor-failure","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:eb33dec0e0cef26005de1cd0c17887708b57d46a4cc76f6d9ab390100dfe48a3","properties":{"rationale":"Agreeing exit terms for external and cloud services reduces lock-in and the impact of a cloud provider's failure or exit.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-tprm-08-6de49908.json","sourceId":"uc:UC-TPRM-08","targetDetailPath":"/data/v1/records/risk-tprm-critical-vendor-failure-cb39c2bc.json","targetId":"risk:tprm-critical-vendor-failure","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:ebe31180cd6a5c287a792f35ab12db6b2cc0ee0913b6b1869d82bd98b2027a25","properties":{"rationale":"Including suppliers in incident response and recovery with pre-defined coordination reduces the impact of an incident-driven prolonged outage.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-tprm-05-039b6350.json","sourceId":"uc:UC-TPRM-05","targetDetailPath":"/data/v1/records/risk-tprm-critical-vendor-failure-cb39c2bc.json","targetId":"risk:tprm-critical-vendor-failure","type":"mitigates"}],"schemaVersion":1}