When a Critical Supplier Goes Quiet: Rehearsing the First 24 Hours
A critical supplier's outage becomes your outage on their schedule. Rehearse the first 24 hours before their bad day becomes yours.

Your systems are fine. Your people are fine. And your business is down, because the supplier that runs your bookings, your payments, or your logistics platform is having their worst day, and their status page says they are 'investigating.'
The maddening part of a supplier outage is the asymmetry: you carry the customer impact while holding none of the controls. What you can control is the first 24 hours - how fast you know, what your people do instead, and what you tell customers while the supplier investigates.
That day goes much better rehearsed. A two-hour walkthrough of one critical supplier's failure pays for itself the first time it happens for real.
TLDR
Name the five suppliers whose bad day becomes your bad day.
Decide detection: how you learn about their outage before your customers tell you.
Pre-build the workaround: manual process, alternate route, or managed pause.
Draft the customer holding message before you need it.
Rehearse the first 24 hours once a year per critical supplier.
Start with the short list
Every company has five or fewer suppliers whose failure stops the business: the platform the product runs on, the payment processor, the logistics or scheduling backbone, the identity provider, the communications suite. Write the list down. Everything else is inconvenience; these are outages.
For each one, answer three questions while calm: how would we know, what would we do, what would we say. If any answer is 'we would figure it out,' that is the rehearsal agenda.
Detection: know before your customers tell you
The worst sequence is customer, support ticket, social media, then your own team. Subscribe to the supplier's status channels, assign someone to watch them on incident days, and know the internal signals - error rates, queue depth - that often fire before the supplier admits anything.
Set the trigger for declaring your own incident. Waiting for the supplier to confirm before you mobilize hands them your timeline.
The workaround is the product
For each critical supplier, the rehearsed question is: what do our people physically do at hour two? Sometimes it is a manual process - paper forms, phone orders, a spreadsheet. Sometimes it is an alternate route. Sometimes it is a managed pause with a good message. All three are survivable; improvisation is not.
This fictional example shows a rehearsal record. It is an illustration, not a real plan.
| Supplier | Failure assumed | Workaround rehearsed | Longest tolerable outage |
|---|---|---|---|
| Scheduling platform | Full outage | Phone booking + shared spreadsheet | 1 business day |
| Payment processor | Card processing down | Invoicing path for existing customers | 3 days |
| Identity provider | Staff login unavailable | Break-glass local admin process | 4 hours |
Test the workaround for real at least once - actually run an hour on the spreadsheet. A workaround that has never been used is a rumor.
Say something early and honest
Customers tolerate supplier outages remarkably well when told promptly and plainly: what is affected, what you are doing, when you will update next. They tolerate silence not at all. Draft the holding message now, for each critical supplier, and pre-agree who can send it.
NIST's supply chain guidance frames supplier resilience as a shared dependency to be managed, not a contract to be blamed. The rehearsal is the management: when the supplier's bad day comes, your first 24 hours are already decided.
The related discussion of resilience by design is worth your time alongside this one.
Frequently asked questions
How do we pick which suppliers make the list?
One test: if this supplier were down for a full business day, would our customers notice? If yes, they are on the list. Most companies land between three and five.
What if there is no realistic workaround?
Then the honest answer is a managed pause, and the rehearsal focuses on communication and recovery order. Knowing that in advance changes decisions - contract terms, architecture, and sometimes whether the dependency is acceptable at all.
Should the supplier participate in the rehearsal?
Not necessary for the first pass - you are rehearsing your response, not theirs. For the most critical relationships, a joint conversation about escalation routes and status communication is worth having once you know your own plan.
A Defensible Next Step
Write your five-supplier list this week and rehearse the first 24 hours of one of them failing. Two hours in a room now buys you a controlled day when it happens. Book a Decision-Clarity Call if you want the rehearsal run for you.
Get Board-Ready on AI and Cyber Risk
A 30-minute call. No charge. You'll leave with a clear read on where your oversight stands and what to do about it.


