Which outside company could interrupt your operations if it stopped delivering tomorrow? The answer might be a materials supplier, transportation provider, payroll company, technology vendor, or equipment maintenance firm. For businesses in Nassau County, Suffolk County, and throughout New York, supply chain risk management begins with understanding those dependencies and examining what happens when an essential resource becomes unavailable.
This guide combines official federal resources with suggested planning questions for business owners. Examples are hypothetical and do not describe actual client incidents. Risk Management International LTD (RMI) provides strategic and operational risk management consulting, with supply chain risk identified among the exposures addressed in its published services.
Begin With Your Business Dependencies
A suggested first step is to identify the outside organizations that support essential activities. Create a working list of suppliers and service providers, the resources they deliver, the locations they support, and the employees responsible for managing each relationship.
Look beyond purchasing volume. A relatively inexpensive service may still be essential to completing customer work. Conversely, a large purchase does not automatically represent the most urgent continuity concern.
For a hypothetical Nassau County manufacturer, the review might distinguish packaging supplies from a specialized replacement component. For a Suffolk County professional office, it might focus on document access, communications, and outsourced administrative services.
Use Preparedness Resources to Structure the Review
The U.S. Small Business Administration provides emergency preparedness and business resilience resources. Its business management guidance also points organizations to FEMA’s supply chain resilience material for understanding how local supply chains connect and how disruptions can be addressed.
A practical application is to connect supplier questions with the company’s broader preparedness planning. Ask which business activities would stop, who would make decisions, and what information would be needed to evaluate alternatives.
The objective is to document the organization’s actual dependencies. A generic checklist should support that discussion rather than replace it.
Source: U.S. Small Business Administration — Business Management and Emergency Preparedness Resources.
Examine the Consequences of a Supplier Interruption
For each important dependency, consider a defined interruption scenario. Suggested questions include what happens after a missed delivery, which customer commitments are affected, and whether existing inventory or another process provides a temporary alternative.
Keep assumptions visible. If management believes it can continue operating for several days, identify the records or operating information supporting that estimate. Separate confirmed facts from judgments that still require testing.
For example, a hypothetical Long Island distributor could compare available stock with scheduled orders. The resulting estimate should reflect that company’s records rather than an unsupported industry-wide assumption.
Distinguish an Alternative From a Confirmed Arrangement
Identifying a second supplier is a useful discussion point, but it does not establish that the supplier can provide the required product or service when needed.
A suggested review should examine specifications, available capacity, lead times, delivery arrangements, and any approval steps required before switching. Record which points have been confirmed directly and which remain open.
A hypothetical Suffolk County business might locate another supplier for a critical item but still need to confirm compatibility with its equipment. Until that question is resolved, the alternative should remain a proposed option rather than a completed continuity measure.
Include Technology Providers in the Supply Chain Review
NIST’s Cybersecurity Framework 2.0 supply chain quick-start guide addresses organizations acquiring and supplying technology products and services. It describes using the framework to establish cybersecurity supply chain risk management capabilities and communicate supplier requirements.
This guidance concerns cybersecurity supply chain risks specifically. It should not be presented as a complete framework for every physical inventory or transportation decision.
For a practical technology review, identify the providers supporting essential applications and information. Ask who manages each relationship, which expectations have been communicated, and what evidence is available to evaluate the arrangement.
Source: NIST SP 1305 — Cybersecurity Supply Chain Risk Management Quick-Start Guide.
Document Security Expectations for Vendors
The Federal Trade Commission recommends putting vendor security expectations in writing, establishing a process to verify compliance, and updating arrangements as security needs change. Its guidance also recommends limiting vendor access to information based on legitimate business needs.
A suggested vendor record can identify the information accessed, the purpose of that access, and the person responsible for approving and removing it. Ask qualified technical staff to evaluate the relevant safeguards.
For a hypothetical Port Washington business using an outside technology provider, the review could examine administrative account access and the process for ending that access when the engagement finishes.
Source: FTC — Cybersecurity for Small Business: Vendor Security.
Consider Suppliers Beyond the Immediate Provider
CISA publishes a resource guide designed to help small and medium-sized businesses develop an information and communications technology supply chain risk management plan. The resource provides a starting point for tailoring a plan to the business.
One practical discussion is whether an important provider depends on another organization to deliver its service. Ask the provider which dependencies it can explain and what contingency arrangements are available.
Do not assume that purchasing from two companies eliminates a shared dependency. Record what is known about their arrangements and identify questions that require additional information.
Source: CISA — Resource Guide for Developing a Resilient Supply Chain Risk Management Plan.
Review Contractual Questions With Qualified Advisers
A suggested contract review can identify delivery commitments, service expectations, escalation contacts, and procedures for addressing interrupted performance. Extract the actual wording before discussing what the agreement requires.
Questions involving legal interpretation, indemnification, termination rights, or liability should be referred to qualified legal counsel. Operational planning should not assume that a contract clause guarantees uninterrupted service.
For example, an agreement may describe a provider’s response process, while management still needs a practical plan for handling delayed work. Keep the legal question and the operational question clearly documented so each receives the appropriate review.
Connect Supplier Disruptions With Business Continuity
Ready.gov identifies communications planning, information technology recovery, and continuity planning as components of business preparedness. It also emphasizes training and exercises.
A suggested exercise can focus on one critical supplier becoming unavailable. Ask participants how they would verify the situation, prioritize work, communicate with affected customers, and evaluate alternatives.
Record the information participants could access and the questions they could not answer. An exercise should reveal limitations rather than produce an unsupported declaration that the organization is fully prepared.
Source: Ready.gov — Ready Business.
Include Financial Exposure in the Discussion
As a practical assessment step, consider the financial consequences of a defined disruption using available business records. Suggested categories include delayed revenue, additional purchasing costs, and expenses associated with alternative operating arrangements.
Document the assumptions behind each estimate. Avoid presenting an illustrative scenario as an expected loss or guaranteed outcome.
Insurance questions should be evaluated against actual policy language with appropriately qualified professionals. Do not assume that every supplier failure, transportation delay, or service outage is covered by an existing insurance program.
Assign Actions and Track Unresolved Questions
A suggested action register can identify the dependency, supporting information, unresolved concern, responsible person, and next review step. Use a status that distinguishes proposed arrangements from verified capabilities.
For example, contacting an alternative supplier is different from confirming its ability to meet the company’s requirements. Likewise, obtaining a vendor questionnaire is different from evaluating the answers.
Keep the register focused on decisions management needs to make. Where information is incomplete, identify what additional evidence would allow the business to assess the issue more reliably.
Revisit the Review When Operations Change
Consider another review when the business adds a location, changes a critical system, introduces a new product, or becomes more dependent on a particular provider. This is a suggested management practice rather than a universal legal review schedule.
For businesses operating across Nassau and Suffolk counties, document meaningful differences among locations. One branch may have different inventory, delivery arrangements, or technology dependencies from another.
Update the underlying information before assuming that an earlier assessment describes the current organization. Retain the reasoning behind important decisions so future reviews can distinguish verified changes from outdated assumptions.
Discuss Supply Chain Risk With RMI
RMI’s Strategic and Operational Risk Management page identifies supply chain risks, cyber risks, and project-related risks among the exposures addressed through operational risk management. Its published approach connects risk oversight with business objectives and operational planning.
Businesses considering consulting support can discuss which dependencies they want reviewed, what information is available, and the deliverables expected from the engagement. Clarify when additional legal, technical, insurance, or industry-specific expertise is necessary.
RMI does not sell insurance. A consulting assessment should not be represented as a guarantee that disruptions will be prevented or that every resulting loss will be covered.
Company source: Risk Management International LTD — Strategic and Operational Risk Management.
To discuss your organization’s supply chain exposures and broader risk management priorities, visit the RMI contact page.
This article provides general educational information. Examples are hypothetical. Suggested planning practices should be adapted to actual operations, and legal obligations and insurance coverage should be evaluated with qualified professionals.