Uncategorized

Which outside company could interrupt your operations if it stopped delivering tomorrow? The answer might be a materials supplier, transportation provider, payroll company, technology vendor, or equipment maintenance firm. For businesses in Nassau County, Suffolk County, and throughout New York, supply chain risk management begins with understanding those dependencies and examining what happens when an essential resource becomes unavailable. This guide combines official federal resources with suggested planning questions for business owners. Examples are hypothetical and do not describe actual client incidents. Risk Management International LTD (RMI) provides strategic and operational risk management consulting, with supply chain risk identified among the exposures addressed in its published services. Begin With Your Business Dependencies A suggested first step is to identify the outside organizations that support essential activities. Create a working list of suppliers and service providers, the resources they deliver, the locations they support, and the employees responsible for managing each relationship. Look beyond purchasing volume. A relatively inexpensive service may still be essential to completing customer work. Conversely, a large purchase does not automatically represent the most urgent continuity concern. For a hypothetical Nassau County manufacturer, the review might distinguish packaging supplies from a specialized replacement component. For a Suffolk County professional office, it might focus on document access, communications, and outsourced administrative services. Use Preparedness Resources to Structure the Review The U.S. Small Business Administration provides emergency preparedness and business resilience resources. Its business management guidance also points organizations to FEMA’s supply chain resilience material for understanding how local supply chains connect and how disruptions can be addressed. A practical application is to connect supplier questions with the company’s broader preparedness planning. Ask which business activities would stop, who would make decisions, and what information would be needed to evaluate alternatives. The objective is to document the organization’s actual dependencies. A generic checklist should support that discussion rather than replace it. Source: U.S. Small Business Administration — Business Management and Emergency Preparedness Resources. Examine the Consequences of a Supplier Interruption For each important dependency, consider a defined interruption scenario. Suggested questions include what happens after a missed delivery, which customer commitments are affected, and whether existing inventory or another process provides a temporary alternative. Keep assumptions visible. If management believes it can continue operating for several days, identify the records or operating information supporting that estimate. Separate confirmed facts from judgments that still require testing. For example, a hypothetical Long Island distributor could compare available stock with scheduled orders. The resulting estimate should reflect that company’s records rather than an unsupported industry-wide assumption. Distinguish an Alternative From a Confirmed Arrangement Identifying a second supplier is a useful discussion point, but it does not establish that the supplier can provide the required product or service when needed. A suggested review should examine specifications, available capacity, lead times, delivery arrangements, and any approval steps required before switching. Record which points have been confirmed directly and which remain open. A hypothetical Suffolk County business might locate another supplier for a critical item but still need to confirm compatibility with its equipment. Until that question is resolved, the alternative should remain a proposed option rather than a completed continuity measure. Include Technology Providers in the Supply Chain Review NIST’s Cybersecurity Framework 2.0 supply chain quick-start guide addresses organizations acquiring and supplying technology products and services. It describes using the framework to establish cybersecurity supply chain risk management capabilities and communicate supplier requirements. This guidance concerns cybersecurity supply chain risks specifically. It should not be presented as a complete framework for every physical inventory or transportation decision. For a practical technology review, identify the providers supporting essential applications and information. Ask who manages each relationship, which expectations have been communicated, and what evidence is available to evaluate the arrangement. Source: NIST SP 1305 — Cybersecurity Supply Chain Risk Management Quick-Start Guide. Document Security Expectations for Vendors The Federal Trade Commission recommends putting vendor security expectations in writing, establishing a process to verify compliance, and updating arrangements as security needs change. Its guidance also recommends limiting vendor access to information based on legitimate business needs. A suggested vendor record can identify the information accessed, the purpose of that access, and the person responsible for approving and removing it. Ask qualified technical staff to evaluate the relevant safeguards. For a hypothetical Port Washington business using an outside technology provider, the review could examine administrative account access and the process for ending that access when the engagement finishes. Source: FTC — Cybersecurity for Small Business: Vendor Security. Consider Suppliers Beyond the Immediate Provider CISA publishes a resource guide designed to help small and medium-sized businesses develop an information and communications technology supply chain risk management plan. The resource provides a starting point for tailoring a plan to the business. One practical discussion is whether an important provider depends on another organization to deliver its service. Ask the provider which dependencies it can explain and what contingency arrangements are available. Do not assume that purchasing from two companies eliminates a shared dependency. Record what is known about their arrangements and identify questions that require additional information. Source: CISA — Resource Guide for Developing a Resilient Supply Chain Risk Management Plan. Review Contractual Questions With Qualified Advisers A suggested contract review can identify delivery commitments, service expectations, escalation contacts, and procedures for addressing interrupted performance. Extract the actual wording before discussing what the agreement requires. Questions involving legal interpretation, indemnification, termination rights, or liability should be referred to qualified legal counsel. Operational planning should not assume that a contract clause guarantees uninterrupted service. For example, an agreement may describe a provider’s response process, while management still needs a practical plan for handling delayed work. Keep the legal question and the operational question clearly documented so each receives the appropriate review. Connect Supplier Disruptions With Business Continuity Ready.gov identifies communications planning, information technology recovery, and continuity planning as components of business preparedness. It also emphasizes training and exercises. A suggested exercise can focus on one critical supplier becoming unavailable.

Commercial flood risk management involves more than checking whether a business has an insurance policy. It requires examining the property, understanding which assets support operations, reviewing insurance terms, and preparing for interruptions. For businesses in Nassau County, Suffolk County, and throughout New York, those questions should be addressed using location-specific information and the actual circumstances of the organization. This guide draws on official federal preparedness resources, National Flood Insurance Program guidance, and New York State insurance information. It also includes suggested review questions and hypothetical examples. Risk Management International LTD (RMI) provides risk management consulting, including insurance program reviews and risk financing services. RMI does not sell insurance. Start With Location-Specific Flood Information The National Flood Insurance Program directs businesses and other property users to FEMA’s Flood Map Service Center to research flood hazard information by address. The federal Climate Resilience Toolkit also identifies the center as a resource for official flood maps and related hazard products. For a Long Island business, a practical starting point is to identify every location included in the review. Record the address, how the premises are used, and the source and date of the mapping information consulted. Do not assign the same exposure to all Nassau or Suffolk County properties. A regional description cannot replace examination of a particular building and its operations. Sources: National Flood Insurance Program — FloodSmart and U.S. Climate Resilience Toolkit — FEMA Flood Map Service Center. Do Not Assume Commercial Property Insurance Includes Flood NFIP guidance explains that flood damage typically is not covered by standard commercial property insurance. Its commercial coverage resources distinguish flood insurance from the protection a business may already have through another property policy. A suggested insurance review should therefore ask whether flood is addressed, which policy provides the relevant protection, and what exclusions or limitations require explanation. Request answers supported by actual policy documents. For example, a hypothetical Nassau County office could have property insurance while still needing clarification about flood exposure. The existence of a property policy alone does not answer that question. Source: NFIP — The Ins and Outs of Commercial Coverage. Separate Building Coverage From Contents Coverage NFIP’s business guidance explains that building coverage and contents coverage address different property. Building coverage concerns the structure and covered systems or fixtures. Contents coverage concerns covered items inside the business, such as inventory, furniture, and machinery. The guidance states that contents coverage must be purchased separately from building coverage and that the two have their own limits and deductibles. A practical application is to list the property the organization owns or uses and ask which coverage applies. Do not assume that protection arranged for a building owner also resolves the insurance needs of a tenant’s business property. Source: NFIP — Protecting Businesses With Flood Insurance. Understand Limits and Valuation NFIP’s commercial coverage guidance identifies available limits of up to $500,000 for commercial building coverage and up to $500,000 for commercial personal property coverage. It also explains that commercial flood losses are generally valued using actual cash value, which accounts for physical depreciation. Those published limits are not a recommendation for the amount any particular business should purchase. A suggested review can compare the available protection with documented property values and the business’s financial exposure. Ask an appropriately qualified insurance professional to explain the valuation provisions, deductibles, and options relevant to the organization. Avoid assuming that a property’s purchase price or accounting value establishes the appropriate insurance amount. Review Business Interruption Separately NFIP guidance states that its commercial flood policies do not cover financial losses from business interruption or loss of use. Physical damage protection and lost-income protection therefore require separate questions. A hypothetical Suffolk County distributor might need to consider damaged stock alongside the consequences of being unable to fulfill orders. The operational interruption would not automatically be addressed simply because the business purchased NFIP property coverage. Ask the insurance representative whether any available policy addresses the relevant interruption exposure and what conditions apply. This article does not establish the availability or scope of a particular private insurance product. Read the Actual Policy Terms The New York State Department of Financial Services advises businesses to understand the terms, limitations, and exclusions in their property insurance. Its small-business guidance explains that different businesses have different coverage needs and discusses distinctions among valuation approaches. For a flood-related review, assemble complete policies and endorsements rather than relying only on a short summary. Record questions about the property insured, relevant locations, covered causes of loss, and applicable financial limits. Where an explanation remains unclear, request written clarification from the appropriate insurance professional. A review should identify unresolved questions accurately instead of describing uncertain protection as confirmed coverage. Source: New York State Department of Financial Services — Information for Small Businesses. Connect Insurance Review With Preparedness Ready.gov provides business preparedness resources covering communications, technology recovery, and business continuity. Its toolkit series includes inland flooding and power outages, among other hazards. The program also emphasizes training and exercises. A suggested application is to identify which preparedness resources fit the organization’s operations and assign responsibility for reviewing them. Record the arrangements that have been confirmed and the actions still awaiting completion. For example, a hypothetical Port Washington business could examine how it would communicate with employees if its normal workspace became unavailable. The planning exercise should test assumptions rather than simply list an alternative location or communication method. Source: Ready.gov — Ready Business. Tailor the Plan to the Business The U.S. Small Business Administration recommends assessing business vulnerabilities, preparing a response plan tailored to operations, and practicing the plan with employees. It identifies flooding among the hazards businesses can examine during preparedness planning. A practical review might identify essential activities, the information needed to perform them, and the people authorized to make decisions during disruption. Keep the plan accessible through an appropriate method. For an organization with several Long Island locations, discuss whether another site can actually support interrupted work. Document staffing, equipment, and access questions before treating relocation

Cybersecurity decisions affect more than computers. They involve business information, employee responsibilities, outside providers, payment processes, and the ability to continue serving customers. For organizations in Nassau County, Suffolk County, and throughout New York, a useful cybersecurity risk review connects technical questions with the activities the business depends on every day. This guide draws on official resources from the National Institute of Standards and Technology, the Federal Trade Commission, and the FBI. It includes suggested planning questions and clearly identified hypothetical examples. Risk Management International LTD (RMI) provides business risk management consulting; its published services include risk identification, insurance program review, and strategic and operational risk management. Use a Framework to Organize the Discussion NIST’s Cybersecurity Framework 2.0 Small Business Quick-Start Guide provides an introduction for organizations with modest or no existing cybersecurity plans. It organizes cybersecurity risk management around six functions: Govern, Identify, Protect, Detect, Respond, and Recover. These functions provide a structure for discussing responsibilities, understanding exposures, implementing safeguards, recognizing problems, and preparing for recovery. They should be considered together rather than treated as isolated purchases or one-time projects. A suggested first step is to identify which person coordinates each area and what information management needs to evaluate progress. Using a framework does not establish that a business meets every legal, contractual, or technical requirement. Source: NIST — Cybersecurity Framework 2.0 Small Business Quick-Start Guide. Start With Essential Business Activities Before selecting new tools, document which activities depend on digital systems. Suggested questions include how employees communicate with customers, where work records are stored, which applications support billing, and who controls access to those services. For example, a hypothetical Nassau County professional office might depend on email, scheduling software, and shared client documents. A hypothetical Suffolk County distributor might also rely on inventory applications and electronic delivery records. These examples illustrate different assessment questions rather than establish the needs of every company in those industries. Record what is known and what still requires confirmation. A service described as essential should have an identified business owner who can explain the consequences of its unavailability. Review Basic Safeguards With Your Technology Provider The FTC’s small-business cybersecurity guidance recommends updating software, regularly backing up important files, protecting sensitive information, and using strong passwords. It also recommends encryption and multifactor authentication as parts of protecting business information. A practical review can ask the technology provider to identify which safeguards are implemented, which systems are included, and how their operation is checked. Distinguish a recommendation from a completed configuration. For instance, a proposal to enable additional account protection should remain an open action until the responsible person confirms implementation. Avoid describing the entire organization as protected based on a setting enabled for only one account. Source: FTC — Cybersecurity for Small Business. Examine Multifactor Authentication Coverage CISA recommends requiring multifactor authentication for remote access to an organization’s network and for privileged or administrative access. Its business guidance also encourages moving toward phishing-resistant authentication. For an internal assessment, ask which accounts have multifactor authentication, which methods are used, and how exceptions are approved. Include the accounts used to administer important business services. A suggested action list can record the service, account owner, current authentication method, and unresolved questions. Qualified technical staff should evaluate suitable configurations and recovery arrangements. Multifactor authentication is a safeguard, not a guarantee that an account cannot be compromised. Source: CISA — Require Multifactor Authentication. Help Employees Recognize Phishing The FBI explains that phishing messages may impersonate legitimate organizations and ask recipients to disclose information or visit a fraudulent website. Its guidance recommends examining requests carefully and avoiding suspicious links or attachments. A practical employee reporting process can identify whom to contact when a message seems unusual. Give employees a way to ask questions without requiring them to make a technical determination themselves. As an illustrative example, a worker receiving an unexpected request for account information could contact the established internal support person through a known channel. The example demonstrates a verification habit rather than a complete incident response procedure. Source: FBI — Spoofing and Phishing. Review Payment Changes Separately The FBI’s Internet Crime Complaint Center describes business email compromise as a scam targeting businesses and individuals making transfers of funds. This makes payment instructions an important subject for a business risk review. A suggested administrative control is to establish an independent verification process for changes to payment details. Management should define who performs the verification, which trusted contact information is used, and how the confirmation is documented. For a hypothetical Long Island company, an email requesting a new bank account would trigger that established process. A familiar sender name should not substitute for the required verification. This example does not imply that every unusual payment request is fraudulent. Source: FBI Internet Crime Complaint Center — Business Email Compromise. Include Vendors With Access to Information The FTC’s vendor security guidance recommends evaluating providers’ security practices and limiting access to information. Where a vendor has a legitimate business need, the FTC advises granting access on a need-to-know basis and only for the time necessary to perform the task. A practical vendor inventory can identify the service provided, the information accessed, the internal relationship owner, and how access is removed when the work ends. For a hypothetical Port Washington business using an outside support provider, management could ask which accounts the provider uses and who approves changes. Document the response instead of assuming that outsourcing the service answers every security question. Source: FTC — Cybersecurity for Small Business: Vendor Security. Prepare for a Suspected Data Breach The FTC’s breach response guide recommends promptly mobilizing an appropriate response team. Depending on the organization and incident, that team may include information security, technology, legal, operations, communications, and forensic specialists. The guide also recommends consulting legal counsel about applicable laws. Notification obligations and technical response steps depend on the circumstances. A suggested preparation exercise is to identify the relevant contacts before an incident occurs and determine how they can be reached if normal email is