Albert Heijn couldn’t deliver for days in mid-October. A cyberincident brought its distribution centres to a standstill, orders went unprocessed and supply stalled. For the supermarket itself, that’s a difficult week. For the growers, wholesalers and transport companies that work around those distribution centres, it’s something else entirely: a chunk of their revenue, planning and staffing disappears, without them having caused any of it.
A hack somewhere else, a problem for you
Your own security can be fully in order and you can still grind to a halt, because the party responsible for a large share of your revenue is not. That’s a different situation from what we wrote about earlier, panic during a hack at your own company. Here, the moment that matters is when a chain partner goes down and you feel the consequences, while staying out of the incident itself.
The dependency is often known, the plan usually isn’t
Most business owners know exactly who their biggest customer or supplier is. What’s often missing is a worked-out answer to what happens if that party is unreachable for three days, a week, or longer. Does your warehouse keep filling up? Do you need to redeploy staff? Can you temporarily deliver elsewhere, or does your planning depend entirely on one customer? Without answers to those questions, the first response to a disruption is usually improvisation: phone calls, meetings, and hoping it blows over quickly.
Continuity starts with policy, not improvisation
At Motics we look at situations like this as part of continuity as a whole, not as a separate ICT question. We call that domain BCT: business continuity, with processes as one of the themes within it. The starting point is simple. You can only respond well to a chain partner’s disruption if you’ve decided in advance how you’ll do it. What scenarios are realistic, who makes which decision, and within what time do you need to be able to deliver or receive again? That policy has nothing to do with technology yet. It’s about agreements, roles and the order in which you act. Only after that do you look at which systems can support it.
What you can do now
A few steps you can take without a major investment.
Map out which customers and suppliers are large enough that their disruption directly hits your process. That’s the first step: measuring before you make policy. Without that overview, you don’t actually know where your risk sits.
Describe a few scenarios for each major dependency. What do you do after a few days of disruption, and what after a few weeks? What alternatives do you have then, and who arranges them?
Decide in advance how you communicate when a chain partner goes down. Who do you inform first, internally and externally, and through which channel? Nothing is as confusing as a crisis where everyone decides on their own who to call.
Determine your recovery time. How many days can you bridge before it genuinely hurts your business, in revenue or in staffing? That number tells you how quickly you need to switch to an alternative scenario.
Involve the people who notice problems first, often planning, logistics or sales, in drawing up this policy. They know the practical bottlenecks better than anyone, and a plan they helped shape is a plan that actually gets followed when it matters.
From a feeling to something you can show
Many companies think they know what they’d do if something went wrong. That feeling isn’t a plan. More and more industry bodies and chain partners are asking businesses to show how they handle this kind of risk. For companies working to be demonstrably ready for NIS2, a documented continuity plan counts for more than the feeling that it’ll probably be fine. That doesn’t start with new software, but with the question of which dependencies you have, and what you’ve agreed for the moment one of those chain partners goes down.
A few questions we’re often asked
Do I need to document this for every customer or supplier?
No, start with the handful of parties whose disruption would genuinely hit your revenue or process. For most SMEs that’s a short list, not dozens of names. Expand it later once you have an approach that actually works.
What if my biggest customer doesn’t share what’s going on?
That happens more often than you’d like, especially while an investigation is still ongoing. Build your plan around signals you can observe yourself, such as orders that stop coming in, rather than around official information from outside, and agree in advance which signal triggers which step.
Is this only relevant if I work directly with a large party?
No, even a few links further down the chain, say as a supplier to a supplier, you can feel the consequences. Ask yourself where your revenue and planning actually come from, and trace that line back a few steps.
How often should I update a continuity plan like this?
At least once a year, and certainly after a change in your biggest customers or suppliers. A plan that’s never updated quickly stops matching how your business actually operates.
Curious where your business is exposed if a chain partner goes down? At Motics we map that kind of dependency together with you, as part of a broader view of your continuity.
