CRP Supply Chain Resilience & Vendor Management Flashcards

Which international standard provides guidance on supply chain security and continuity management?

Answer: ISO 28000

ISO 28000 specifies requirements for security management systems for the supply chain, covering risk assessment and continuity.

What is a 'fourth-party risk' in supply chain resilience terminology?

Answer: Risk from a vendor's vendor's vendor (beyond Tier 3)

Fourth-party risk refers to exposure from suppliers at the fourth tier or beyond in the supply chain, which are typically invisible to the organization.

Which technique helps an organization understand how a supply chain disruption would cascade across its operations?

Answer: Tabletop exercise focused on supplier failure scenarios

Tabletop exercises simulating supplier failures reveal cascading dependencies and test whether contingency plans are sufficient to maintain operations.

When evaluating a vendor's resilience, which financial indicator is most relevant?

Answer: Vendor's own business continuity plan and financial stability rating

A vendor's BCP quality and financial stability together indicate whether the vendor can sustain operations and recover from disruptions.

What should a supply chain resilience program include to address cybersecurity risks from vendors?

Answer: Third-party cyber risk assessments and contractual security requirements

Third-party cyber risk assessments combined with contractual security requirements ensure vendors meet minimum cybersecurity standards that protect your organization.

In supply chain resilience planning, 'lead time compression' refers to which strategy?

Answer: Reducing the time between an order and delivery to minimize exposure windows

Lead time compression reduces the window during which supply is unavailable by working with suppliers to shorten fulfillment times, decreasing disruption exposure.