Which elements help mitigate disruption risk from vendors in business continuity planning?

• A. Business Impact Analysis, Recovery Time Objective/Recovery Point Objective, and contractually required continuity safeguards
• B. Sanctions screening and data retention policy
• C. Data localization and onboarding timelines
• D. Independent risk function and SOC 2 reports

Answer: (A)

When planning to protect operations from vendor disruptions, you need a clear view of how dependent you are on external services, defined recovery targets, and enforceable resilience commitments from vendors. The combination of a Business Impact Analysis, explicit Recovery Time Objectives and Recovery Point Objectives, and contractually required continuity safeguards does exactly that.

A Business Impact Analysis identifies which vendor-provided services are critical to your processes and estimates the potential consequences if those services are interrupted. That tells you where disruption would hurt most and what recovery requirements those services must meet. Recovery Time Objective and Recovery Point Objective translate those needs into concrete, measurable targets: how quickly you must resume operations and how much data loss is permissible. These targets guide vendor selection, service level agreements, redundancy design, and the prioritization of recovery actions.

Contractually required continuity safeguards ensure vendors legally commit to maintaining appropriate continuity capabilities, testing their plans, and meeting the agreed-upon recovery targets. They also establish remedies if a vendor fails to meet those commitments, which strengthens your resilience posture during an outage.

Other options touch on compliance, data governance, or governance assurances, and while those are important, they don’t directly establish the operational targets and enforceable continuity controls needed to mitigate disruption risk from vendors in a business continuity plan.