---
title: Assessing Third Party Business Continuity Risk
description: Are your third party vendors as serious about business continuity as you are? Here’s how to check.
image: https://bcmmetrics.com/hubfs/Blog%20images/November%20-%20December%202024/fotolia_107226054_subscription_monthly_m.webp
---
[Skip to content](https://bcmmetrics.com/blog/third-party-business-continuity-risk#main-content)
SOLUTIONS
[PRICING](https://bcmmetrics.com/pricing)
USE CASES
RESOURCES
[ABOUT US](https://bcmmetrics.com/about-bcmmetrics)
Flexible BCM software solutions
[See all solutions →](https://bcmmetrics.com/business-continuity-solutions)
[ **REGULATORY COMPLIANCE** A self-assessment tool to evaluate the level of compliance of your business continuity program](https://bcmmetrics.com/business-continuity-solutions/compliance-confidence)
[ **BUSINESS CONTINUITY PLANNING** A single platform where you can build and share business continuity plans (BCPS) across your entire team](https://bcmmetrics.com/business-continuity-solutions/bcm-planner)
[ **BUSINESS IMPACT ANALYSIS** An everyday business impact analysis (BIA) software to help you prepare and plan for anything](https://bcmmetrics.com/business-continuity-solutions/bia-on-demand)
[ **FACILITIES MANAGEMENT** An intuitive icon-based mapping tool to better manage your facilities around the globe](https://bcmmetrics.com/business-continuity-solutions/bcm-one)
[**INSURANCE** Identify critical systems and create streamlined response plans](https://bcmmetrics.com/industry/insurance)
[**HEALTHCARE** Simplify compliance and risk assessments in one platform](https://bcmmetrics.com/industry/healthcare)
[**FINANCE** Manage audits and meet standards with ease](https://bcmmetrics.com/industry/finance)
[** CASE STUDIES** Learn how others have redefined their BC management with BCMMetrics](https://bcmmetrics.com/business-continuity-case-studies)
[** RESOURCE LIBRARY** Access our collection of free downloadable resources](https://bcmmetrics.com/business-continuity-resources)
[** BLOG** Read along for expert BC advice from our senior consultants](https://bcmmetrics.com/blog)
[LOG IN](https://app.bcmmetrics.com/Portal/login.aspx) [VIRTUAL TOUR](https://bcmmetrics.com/virtual-tour-form) [BOOK YOUR DEMO](https://bcmmetrics.com/demo)
.png)
.png)
Risk Management
# Assessing Third Party Business Continuity Risk
Michael Herrera
Published on: June 26, 2017
### Prepare For the Worst with the Best in the Business
Experience capable, consistent, and easy-to-use business continuity management software.
[BOOK YOUR DEMO](https://bcmmetrics.com/demo)
Here’s a tale of two third parties, business continuity edition:
*New York City-based data center operator Telx Group has two facilities in New Jersey. In anticipation of Superstorm Sandy back in 2012, Telx moved its New Jersey operations onto generator power before the storm.It also called in additional employees to work during the storm, stocked up on nonperishable food to feed them, and topped off each data center’s fuel supply well in advance. Not a single one of its customers experienced a data center outage either during or after the hurricane.*
*At the same time,* [*Internet service provider Datagram*](https://www.wired.com/2012/10/ny-sandy-data-center/) *was taking similar precautions. However, the basement of its New York City office building (where the fuel tank pumps were located) was quickly flooding, taking the generators offline. The problem eventually shut down the entire building. Many of Datagram’s customers were impacted by significant downtime as a result of the disaster—with some still offline more than 20 hours after the outage began.*
When it comes to business continuity risks, examples like these highlight the gamble your company takes every time it relies on a third party provider for an essential part of the business—whether it’s for payroll services, call center operations, production facilities, IT services, or anything else. Service providers are an extension of your company and multiply your chances for a disruption.
So if your critical vendors don’t take business continuity as seriously as you do—and have a plan in place to show for it—then it may be time to reassess those relationships.
### [**Are your business recovery plans up to par? Use this free guide to ensure they address all four common categories of disruptions.**](https://mha-it.com/blog/functional-business-impact-analysis-bia)
## **How To Assess Third Party Business Continuity Risk**
Third party risk *can* be assessed and managed, but the process needs to start early in the relationship. Follow these steps to ensure that your vendors continually stay on top of their business continuity risk:
1. Add business continuity language to your service contracts. To hold your critical providers accountable, add specific language to the contract to ensure that they have a valid business continuity program in place and you have the right to evaluate it annually. Then, if at some point down the road either of those factors falls into question, it constitutes breach of contract. [The Continuity Advisor](https://www.thecontinuityadvisor.com/templates/supplier-business-continuity-clause/), an online resource for free business continuity learning materials and resources, provides a useful template for supplier business continuity clauses.
2. Identify which service providers are critical to your business mission. There’s no need to assess all of your service providers—only those that are critical to the mission of your company. Use a [Business Impact Analysis](https://www.mha-it.com/event/bia-101-acp-md-chapter/) to help determine your critical external dependencies.
1. Identify a point of contact for business continuity for each critical vendor. Have each point person’s contact information organized and easily accessible.
1. Create and send a business continuity questionnaire.
2. A well-designed questionnaire should give you some good insight into the state of your vendors’ business continuity programs. (For help on this step, check out these 15 business continuity program metrics; or, complete a comprehensive assessment of your third parties using our [Compliance Confidence online tool.](https://www.mha-it.com/bcmmetrics/compliance-confidence/)) Give vendors a two- to three-week deadline to complete it. But be warned: Not all vendors will be transparent, so make sure your questions dig deep.
1. Analyze the responses. If a vendor is not forthcoming with information or sends you a boilerplate-filled, 2-page summary, you may need to make an onsite visit to find out what you need to know. (Some companies won’t give you access to BC recovery plans or test results unless you view them in person.) Identify gaps in the program and assess how significant the gaps are to their ability to support your business if they suffer a disruption. Weigh and consider the responses with their level of criticality.
1. Identify an action plan to address gaps. If the level of third party risk is too high for any particular vendor due to significant weaknesses in the program, develop a plan and a timeline for addressing them.
1. Follow up. Did the vendor address outstanding issues in the time frame allotted? If not, reevaluate those relationships and consider your options for alternate providers.
## **A Third Party Risk Assessment Tool That Works**
Don’t reinvent the wheel—use the [Compliance Confidence (C2) assessment tool](https://www.mha-it.com/bcmmetrics/compliance-confidence/) as a questionnaire for third party risk evaluation. Part of the [BCMMetrics™ suite of online business continuity software](https://www.mha-it.com/bcmmetrics/), [Compliance Confidence](https://www.mha-it.com/bcmmetrics/compliance-confidence/) can be used with all your third party vendors as a way of evaluating their business continuity programs. It’s simple to give your third party vendors access, easy to fill out, and presents a straightforward “FICO”-like score measuring how well a program stands up to the most current standards and guidelines.
It also highlights areas for improvement, making it easy for you to work with third parties on business continuity goals.
Interested in seeing the tool in action? [Schedule a free demo today.](https://www.mha-it.com/demo/)
## "Business resilience means adapting swiftly, turning challenges into stepping stones for success."
Michael Herrera
---
#### Michael Herrera
Michael Herrera is the Chief Executive Officer (CEO) of MHA. In his role, Michael provides global leadership to the entire set of industry practices and horizontal capabilities within MHA. Under his leadership, MHA has become a leading provider of Business Continuity and Disaster Recovery services to organizations on a global level. He is also the founder of BCMMETRICS, a leading cloud based tool designed to assess business continuity compliance and residual risk. Michael is a well-known and sought after speaker on Business Continuity issues at local and national contingency planner chapter meetings and conferences. Prior to founding MHA, he was a Regional VP for Bank of America, where he was responsible for Business Continuity across the southwest region.
## Other resources you might enjoy
#### [Recovery Time Objective Vs. Recovery Point Objective](https://bcmmetrics.com/blog/recovery-time-objective-vs-recovery-point-objective)
Michael Herrera
[Read More](https://bcmmetrics.com/blog/recovery-time-objective-vs-recovery-point-objective)
#### [5 Critical Signs You Need Business Continuity Software](https://bcmmetrics.com/blog/invest-business-continuity-planning-software)
Michael Herrera
[Read More](https://bcmmetrics.com/blog/invest-business-continuity-planning-software)
#### [Should You Use Business Continuity Standards?](https://bcmmetrics.com/blog/should-you-use-business-continuity-standards)
Michael Herrera
[Read More](https://bcmmetrics.com/blog/should-you-use-business-continuity-standards)
## Ready to start focusing on higher-level challenges?
### 
3820 W Happy Valley Road
Glendale, AZ 85310
USA
[SOLUTIONS](https://bcmmetrics.com/business-continuity-solutions)
- [Regulatory Compliance](https://bcmmetrics.com/business-continuity-solutions/compliance-confidence)
- [Business Impact Analysis](https://bcmmetrics.com/business-continuity-solutions/bia-on-demand)
- [Business Continuity Planning](https://bcmmetrics.com/business-continuity-solutions/bcm-planner)
- [Facilities Management](https://bcmmetrics.com/business-continuity-solutions/bcm-one)
PRICING
- [Our Pricing Model](https://bcmmetrics.com/pricing)
RESOURCES
- [Case Studies](https://bcmmetrics.com/business-continuity-case-studies)
- [Resource Library](https://bcmmetrics.com/business-continuity-resources)
- [Blog](https://bcmmetrics.com/blog)
COMPANY
- [About us](https://bcmmetrics.com/about-bcmmetrics-old)
- [Contact](https://bcmmetrics.com/demo)
- [MHA Consulting](https://www.mha-it.com/)
© 2026 BCMMetrics. All rights reserved. [Privacy Policy](https://bcmmetrics.com/privacy-policy)
```json
{
"@context" : "",
"@type" : "BreadcrumbList",
"itemListElement" : [ {
"@type" : "ListItem",
"item" : "https://bcmmetrics.com",
"name" : "Home",
"position" : 1
}, {
"@type" : "ListItem",
"item" : "https://bcmmetrics.com/blog",
"name" : "Blog",
"position" : 2
}, {
"@type" : "ListItem",
"name" : "Assessing Third Party Business Continuity Risk",
"position" : 3
} ]
}
```
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Michael Herrera",
"url" : "https://bcmmetrics.com/blog/author/michael-herrera"
},
"dateModified" : "2024-12-04T04:53:02.819Z",
"datePublished" : "2017-06-26T11:20:58.000Z",
"headline" : "Assessing Third Party Business Continuity Risk",
"image" : [ "https://bcmmetrics.com/hubfs/Blog%20images/November%20-%20December%202024/fotolia_107226054_subscription_monthly_m.webp" ],
"mainEntityOfPage" : {
"@id" : "https://bcmmetrics.com/blog/third-party-business-continuity-risk",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://bcmmetrics.com/hubfs/Group%201171274345.svg"
}
}
}
```