Why suppliers are in scope
NCEMA 7000 clause 8 contains a requirement most suppliers have never read but increasingly feel: where a client's prioritised activity depends on an external provider, the client shall evaluate that provider's business continuity arrangements in relation to the dependency — and address the vulnerabilities found. In plain terms: if your delivery stopping would stop them, your continuity is part of their compliance.
This is how a government standard reaches private companies without a single new law: through supplier registration portals, tender questionnaires and contract clauses. Oil and gas operators, utilities, banks and government-related entities all run supplier qualification — and business continuity questions are appearing in them across the GCC.
What clients typically ask for
- A business continuity policy and plan covering the services you deliver to them — not your whole company, the dependency.
- Recovery time commitments. How quickly you restore delivery after a disruption, and what workarounds bridge the gap.
- Evidence of testing. An exercise report from the last 12 months beats any policy statement.
- Your own critical dependencies. Sub-suppliers, single facilities, key people — clients increasingly ask one level down.
- Incident communication. Who calls whom within which hours when your delivery is at risk.
The pattern we see in supplier audits: the question is rarely «do you have a plan?» anymore. It is «show us the last time you tested it». A one-day tabletop exercise with a written report answers it.
A pragmatic preparation path
- 1 · Scope the dependency. List which clients depend on which of your services, facilities and people. That — not your org chart — defines the plan.
- 2 · Run a focused BIA. For those services: cost of a lost day, realistic recovery times, single points of failure.
- 3 · Write the plan you can execute. Alternate facility or route, technology recovery, named first-hours authority. Short and true beats long and aspirational.
- 4 · Test once, honestly. A half-day scenario exercise; write down what broke; fix the top three findings.
- 5 · Package the evidence. A supplier-facing continuity summary you can attach to any tender in minutes — consistent with NCEMA 7000 language.
Frequently asked questions
We are a small company. Does NCEMA 7000 really apply to us?
The standard itself is written to scale with organisational complexity — and your client does not need you certified, they need evidence your delivery survives a bad day. A focused plan for the dependency, tested once, is usually enough.
Can we just answer the tender questionnaire without building anything?
You can — once. Questionnaires are increasingly followed by audits and incident clauses with penalties. Paper answers create contract risk; a minimal working system costs less than one lost contract.
How fast can a supplier become audit-ready?
For a single-service dependency: 4-8 weeks for the focused path above. A gap assessment tells you in days whether you need the full path or a light one.