Business Continuity Plan Exercise for Outsourced Services

[eSBee15]

Hello everyone. Just want to check if a company can require their outsourced service providers i.e. contractors and suppliers to test their BCP and submit a report to us. Is this part of ISO 22301 standard requirement or any other ISO standard or just a good practice to implement?

Thank you.

 

[DanBan]

This is not necessarily an ISO requirement but could be part of their contractual obligations to you. Your certification body make audit how YOU are managing your suppliers and part of that will be the checking/DD of their management system.

 

[eSBee15]

This is not necessarily an ISO requirement but could be part of their contractual obligations to you. Your certification body make audit how YOU are managing your suppliers and part of that will be the checking/DD of their management system.

Thanks @DanBan. Our CB has threatened to issue us an NC for not testing our supplier's BCP. I was surprised since this was the first time this was raised. We have tested our own BCP but I am trying to find out which clause in the standard requires testing of our supplier's BCP.

 

[DanBan]

To be clear - YOU do not need to test suppliers BC plans, they (the CB) will be checking how you are checking on your supplier (think of yourself as acting like a CB). If however there is nothing in the contract between you and the supplier - you may find it difficult to get them to do things like BC exercise and testing. You can obviously support and guide them.

Contract renewal will be the obvious carrot to dangle!

 

[malasuerte]

What standard was being assessed when the CB determined this NC? This is a bogus NC.

 

[Mikey324]

What requirement did the auditor say had been violated?