Supply Chain ResilienceWhy the second supplier often isn’t one

Many companies secure critical preliminary products with a second supplier and consider the risk to be managed. The defence industry particularly highlights why this approach often fails: An alternative supplier is only helpful if they are qualified, approved, capable of delivering, and quickly available. This article summarises what research reveals about the supply chain resilience of the security and defence industry, why the substitutability of suppliers becomes a core issue, and what contribution Business Continuity Management (BCM) can make – and what it cannot.

The basis is a detailed, literature-based study by the author on the relationship between BCM and supply chain resilience. The focus here is on the results, not the derivation.

Christian Horres

Expert in Business Continuity Management (BCM), risk management, and organisational resilience, particularly in the context of critical infrastructures. His focus is on Business Impact Analyses (BIA), risk analyses, and the development and enhancement of BCM and crisis management structures. Within the NOVELEDGE network, he supports organisations in the practical implementation of resilient structures, considering international standards such as ISO 22301, ISO 27001, and ISO 31000, as well as applicable regulations.

A Building Block of Resilience

Where the supply chain stands in the impact model

Resilience does not arise from a single discipline. The NOVELEDGE impact model, presented in the foundational article Resilience as a Complete System, describes how management systems influence an organisation’s performance and benefits through organisational resilience. This article focuses on two areas: supply chain management as one of the disciplines in Station 1 and the relationship model, i.e., how BCM translates and manages the supply chain’s contribution to resilience.

For each component, two questions arise: Which capabilities genuinely enhance resilience? And through which management system are these capabilities developed, managed, and evaluated? For the supply chain, research answers the first question quite clearly. The supply chain literature primarily cites flexibility, redundancy, collaboration, and agility as key resilience strategies, assigning them to the phases of preparation, response, and recovery.^[1][2]

The second question is less clear: At which points in the supply network should these capabilities be developed first – and who decides this based on which criteria? This is precisely where Business Continuity Management comes into play – in the sense of the orchestration model as a discipline that aligns the contributions of others to prioritised outcomes.

Defence Industry in Ramp-Up

Why the issue is pressing right now

Since February 2022, the demand for armaments in Europe has risen sharply. Figures from the Stockholm International Peace Research Institute (SIPRI) show how quickly the industry must grow: The four German companies on the list of the 100 largest arms producers – Rheinmetall, ThyssenKrupp, Hensoldt, and Diehl – increased their combined arms sales by 36 percent to 14.9 billion US dollars in 2024. Rheinmetall grew by 47 percent to 8.2 billion US dollars, Diehl by 53 percent to 2.1 billion US dollars.^[3]

The Federal Government responded in December 2024 with the National Security and Defence Industry Strategy.^[4] Companies themselves are also setting new priorities. An AI-supported analysis of the annual reports of major Western defence companies over ten years shows: Since 2022, they have been reporting significantly more frequently on the expansion and diversification of the supplier base, the qualification of additional sources, more local procurement, longer-term agreements, as well as additional capacity and inventory reserves.^[5]

With the ramp-up, a question comes to the forefront that has long been considered a procurement issue: Can the supply chain grow – and will it hold if individual links fail?

What Makes Defence Supply Chains Unique

Small series, long cycles, few suppliers

Defence industry supply chains are evaluated not only on costs, delivery times, and inventories but also on whether they ensure the operational readiness of military systems under changing security conditions. Several characteristics make them particularly vulnerable:

• Small quantities, high specialisation, long life cycles. Components are subject to specific security, quality, and approval requirements. A short-term supplier change is often neither technically nor regulatorily feasible.
• Few suitable producers. The example of the industrial base for ammunition shows that specialised products and a small number of manufacturers lead to pronounced single points of failure.^[6]
• Hard-to-replace resources. A study of Swedish defence supply chains cites qualified personnel, raw materials, security requirements, and established production processes as central complexity drivers.^[7]
• International interconnection. The share of non-European owners in large European defence companies averages about 25 to 30 percent.^[8] This is not automatically a risk. It becomes critical when strategically important components cannot be replaced at short notice, the dependency is not transparent, or access can be politically restricted in a crisis.

This leads to an important distinction: Strategic autonomy is not autarky. It means recognising critical dependencies, assessing their consequences, and maintaining robust alternatives for particularly relevant resources.^[8]

Surge Capability

Another peculiarity is the ability to significantly expand production and deliveries in a short time when demand suddenly increases. It is caught between peacetime efficiency – small batches, low inventories, high utilisation – and scalability in a crisis. Maintaining permanently unused capacities is expensive.^[7]

Studies on developments post-2022 document production bottlenecks, longer delivery times, and increased reliance on subcontractors. At the same time, greater supply security was expected, even though companies did not always have long-term, binding purchase guarantees. Under these conditions, it is economically risky to build up capacities and redundancies in advance.^[7][9] Surge capability is therefore not a characteristic of a single company but arises from the interplay of procurement, investments, supplier capacities, and government requirements. An expansion of capacity at the end manufacturer is ineffective if a subcontractor cannot grow at the same rate.

Dependencies Across Multiple Levels

Many critical dependencies do not lie with the direct contractual partner but two or three levels deeper. Models for military-industrial supply chains therefore emphasize the knowledge of supply chain depth, current risk information, and a systematic assessment of supplier resilience—especially for rare but consequential events whose probability of occurrence can hardly be derived from historical data.^[10] A network model based on the experiences of the US Air Force highlights the importance of a continuously updated situational picture across the entire network.^[11]

Substitutability as a Core Issue

Why the Second Supplier Often Isn’t One

High specialization exacerbates a problem that exists in every industry, but is particularly visible here: A nominally available alternative is not yet a reliable alternative. It only holds if the replacement supplier has the necessary technical capabilities, certifications, materials, and capacities.^[6][7] Diversification therefore does not mean increasing the number of potential providers. It requires qualifying alternatives early and, if necessary, investing in their production capability.^[7][9]

Whether an alternative holds in an emergency can be tested against five characteristics:

The last characteristic is often overlooked: Two suppliers at the first level appear to be diversification. If both source the same intermediate product from the same manufacturer, the dependency remains unchanged—just one level deeper.

Bridging or Buffering

Where a genuine alternative cannot be established, other paths remain: additional inventories, reserved capacities, or the reshoring of critical manufacturing steps into the company itself.^[5][9] Reshoring reduces certain external dependencies but increases capital and coordination needs. Which capabilities are procured from the market and which are secured internally or in closely coordinated partnerships should therefore be guided by three criteria: strategic importance, substitutability, and recovery time.^[9]

The evaluation of business reports distinguishes between two strategic directions: Bridging external dependencies, for example through new sources of supply, and Buffering their impacts, for example through inventories and reserves. The core message is: Not every dependency can or should be eliminated. What matters is whether it is transparent, controllable, and secured.^[5]

The Critical Time Gap

Reaction Time vs. Replacement Time

From a BCM perspective, substitutability can be traced back to a time comparison. On one side is the reaction time: How long can a prioritised service manage without the resource before the impacts become unacceptable? On the other side is the replacement time: How long do procurement, restart, or qualification of an alternative take?

If the reaction time is shorter than the replacement time, a coverage gap arises. This gap cannot be closed after the disruption occurs. Therefore, the continuity solution must be selected, implemented, and reviewed in advance – a purely reactive measure is then regularly insufficient.^[12][13] For defence supply chains, this gap is particularly relevant due to long lead times, fewer suppliers, regulatory requirements, and complex qualification processes.^[7][9][10]

A hypothetical example for illustration: A manufacturer can bridge a shortage of an approved special component with stock for six weeks. After that, the final assembly of a prioritised system comes to a halt. A second supplier exists but is not qualified; qualification would take several months. On paper, the component is doubly secured, but in reality, there is a gap of months. The consequence does not lie in the emergency plan but in a decision today: pre-qualify the second supplier, increase stock, or contractually reserve capacity.

The same logic applies to ramp-up: A supplier can reliably cover normal demand and still be critical because they cannot scale up in time when needed. And a supplier with a low purchase volume can be more critical than a large one if a prioritised service depends on them. Volume and probability alone obscure such differences.

What BCM Contributes

Five Functions and a Chain of Effects

BCM is not the same as resilience. It is a management system that ensures the continuation of prioritised activities.^[14] Its strength lies in linking abstract resilience capabilities to specific services, processes, resources, suppliers, and timeframes. At its core, it fulfils five functions for the supply chain:

• Transparency from the service perspective. The Business Impact Analysis starts with the prioritised products and services and traces the path through activities and resources to the suppliers. A supplier is critical if a prioritised activity depends on them – not because of their purchase volume.^[12][13]
• Time criticality. Maximum tolerable downtimes, recovery time objectives, and minimum capacities indicate how quickly a resource must be replaced. This allows for more precise prioritisation than a pure probability or damage assessment.
• Translation into strategies. Requirements become options: safety stocks, qualified alternative suppliers, reserved capacities, substitute materials, standby agreements, contractual continuity services, or joint exercises. The standards do not demand blanket redundancy; a justified and documented risk acceptance is also possible.^[13]
• Coordination. Critical dependencies can only be assessed together with procurement, supply chain management, production, and risk management – for particularly critical resources, also with suppliers and government procurement agencies.
• Validation and learning. Exercises, incidents, and changes in the supply network show whether assumed recovery times, alternatives, and capacities are still valid. ISO/TS 22318 provides for regular review of continuity requirements with suppliers.^[13]

When expanding the impact model’s Bridge B for the supply chain, the following chain emerges. The solid steps describe what BCM methodically achieves; the dashed connection to resilience is a theoretically grounded assumption, not an empirically fully proven law.

The chain clearly illustrates what BCM is: a translation and governance capability. It does not create capacities, suppliers, or autonomy. It ensures that dependencies are ordered according to their significance for prioritised services – into those that are acceptable and those that need to be secured. How BCM analyses are structured in practice is described in the article on Business Impact Analysis.

From Early Warning Signal to Plan Activation

How the chain operates in ongoing operations is shown by a governance model from a case study: observation and early warning, detection and evaluation of incidents, management through automatic redundancies or manual handling, and finally a predetermined threshold at which the Business Continuity Plan is activated.^[15] This threshold is not the same as the Recovery Time Objective. However, the RTO can be factored into the decision – for instance, if it becomes apparent that recovery will take longer than planned or the minimum capacity will not be reached in time.^[12] The terms RTO, RPO, and MTPD are explained in the article Business Continuity Management – Terms and Contexts.

What Research Shows

Robust Evidence and Open Questions

There is empirical evidence for the link between BCM and supply chain resilience, but no complete proof. Three studies are particularly insightful:

• BCM and Resilience Components. An analysis of 408 responses from the Supply Chain Resilience Report by the Business Continuity Institute links the implementation of BCM with reduced vulnerability and lower operational performance losses during supply chain disruptions. This connection is primarily conveyed through improved visibility, agility, and collaboration. Flexibility and redundancy could not be examined; the authors see the connection as only partially substantiated.^[16]
• Integration of the Supply Chain Function. A survey of 448 manufacturing companies from Germany, Sweden, and Switzerland shows: The general implementation of BCM is associated with limiting reputational damage. In contrast, the integration of the supply chain function into BCM is mainly linked to limiting operational damage – and this is more pronounced the more vulnerable the supply chain is.^[17]
• Systematic Risk Management in the Defence Sector. In the Colombian defence sector, systematic identification and management of risks before and during the COVID-19 pandemic were associated with reduced vulnerability and increased adaptability.^[18]

For classification purposes: Both survey studies are based on cross-sectional data and self-assessments. They show correlations, not cause-and-effect relationships. ISO 22301 describes requirements for a management system but does not prove that organisations conforming to the standard are automatically more resilient.^[12] A direct effect of BCM on financial metrics has also not been proven. The described causal chain should therefore be understood as a justified explanatory model, whose complete empirical verification is still pending. In the impact model, the findings concern stages 1 and 2; the step from supply chain resilience to performance and benefits has not yet been examined for the defence industry.

Where BCM Reaches Its Limits

Capacity, Regulation, and Industrial Policy

The contribution of BCM diminishes where continuity requirements cannot be translated into actionable options. Three factors particularly limit it:

• Low Substitutability: If there is only one qualified manufacturer worldwide, even the best analysis cannot create a second one.
• Lack of Capacity: If all customers ramp up simultaneously, suppliers‘ reserves are quickly exhausted.
• Regulatory Requirements: Approvals, security classifications, and export regulations can exclude obvious alternatives.

This is where the boundary between operational preparedness and industrial and security policy lies. The ability to ramp up also depends on long-term contracts, the distribution of economic risks between the state and industry, and coordination between clients and companies.^[7][9] Many strategic dependencies cannot be resolved by a single company alone.

Two additional points are part of an honest assessment: Firstly, BCM does not finance resilience measures. Inventories, reserved capacities, or qualifications cost money and must be decided outside of BCM – BCM provides the justification. How such measures can be economically evaluated is addressed in the article From Geopolitical Risk to Financial Resilience. Secondly, BCM is not a standard catalogue. Which measure is appropriate depends on the product, the supply network, and the institutional environment.

Seven Questions for Practice

This is how the analysis begins in your own company

For a start, the results can be translated into seven questions. They follow the causal chain and can be asked in any industry, not just in defence:

1. Which products and services must be maintained or prioritised for restoration under disruption conditions?
2. What activities and resources are required for these services?
3. On which direct and indirect suppliers do these resources depend?
4. From what point does an interruption cause unacceptable impacts?
5. What minimum capacity must be available within this period?
6. What alternatives, buffers, or recovery measures are actually available – qualified, permissible, and deliverable in a timely manner?
7. Have these measures been tested under realistic conditions?

Two insights from the investigation assist in implementation. In security-relevant supply chains, suppliers often provide limited information about their upstream suppliers for confidentiality reasons. Therefore, information should be gathered according to priority: first for the resources of the most time-critical services. Additionally, the assessment should be updated not only annually but also on an event-driven basis – in case of changes in capacities, ownership, approvals, or geopolitical conditions.

Conclusion

Making Dependencies Manageable

Supply Chain Resilience is not achieved through a single measure but through the interplay of transparency, buffers, genuine alternatives, coordinated relationships, and the ability to quickly reorganise. The defence industry demonstrates these interconnections under intensified conditions: few providers, lengthy qualification, regulatory limits, and a demand growing faster than capacities.

The central insight is: What matters is not how many suppliers there are, but whether an alternative can truly sustain within the available timeframe. BCM provides the logic for this – from prioritised service through resources and suppliers to time criticality – and translates it into requirements, options, and verified solutions. It does not replace supply chain management or industrial policy precautions. However, it creates the decision-making basis on which both can specifically build.

Frequently Asked Questions

Brief Answers for Practical Use

Further Reading

Additional Components and In-depth Information

• Resilience as a Complete System
• Business Continuity Management
• Business Impact Analysis: Basics and Approach
• From Geopolitical Risk to Financial Resilience
• Supply Chain Act 2026: What Has Been Removed, What Remains, What the CSDDD Changes

Sources

The information in this article is based on the following sources. No direct quotes are taken from paid standards; their contents are paraphrased. The example in the section on the time gap is fictional.

1. Tukamuhabwa, B. R.; Stevenson, M.; Busby, J.; Zorzini, M. (2015): Supply chain resilience: definition, review and theoretical foundations for further study. International Journal of Production Research, 53(18), 5592–5623. doi.org/10.1080/00207543.2015.1037934 ↑
2. Han, Y.; Chong, W. K.; Li, D. (2020): A systematic literature review of the capabilities and performance metrics of supply chain resilience. International Journal of Production Research, 58(15), 4541–4566. doi.org/10.1080/00207543.2020.1785034 ↑
3. Scarazzato, L.; Tian, N.; Lopes da Silva, D.; Liang, X.; Karim, Z. A.; Guiberteau Ricard, J. (2025): The SIPRI Top 100 Arms-producing and Military Services Companies, 2024. SIPRI Fact Sheet, December 2025. doi.org/10.55163/XPGD6816 ↑
4. Bundesministerium für Wirtschaft und Klimaschutz; Bundesministerium der Verteidigung (2024): Kabinett beschließt Nationale Sicherheits- und Verteidigungsindustriestrategie. Press release from 04.12.2024. bundeswirtschaftsministerium.de ↑
5. Aspeteg, J.; Holtström, J.; Rehme, J.; Havemo, E. (2026): Supply chain resilience development in the defence industry: an AI-assisted content analysis of annual reports. Supply Chain Management: An International Journal, 31(7), 38–52. doi.org/10.1108/SCM-10-2025-1017 ↑ ↑ ↑
6. Hamid, S.; Mazzuchi, T. A.; Sarkani, S. (2016): Disruption management in the defense ammunition industrial base. Security Journal, 29(3), 352–366. doi.org/10.1057/sj.2013.32 ↑ ↑
7. Antai, I.; Hellberg, R. (2025): Surge complexities in defense industry supply chains: evidence from multiple case studies. The International Journal of Logistics Management, 36(7), 242–261. doi.org/10.1108/IJLM-07-2024-0458 ↑ ↑ ↑ ↑ ↑ ↑ ↑
8. Kleczka, M.; Vandercruysse, L.; Buts, C.; Du Bois, C. (2024): The Spectrum of Strategic Autonomy in EU Defence Supply Chains. Defence and Peace Economics, 35(4), 427–447. doi.org/10.1080/10242694.2023.2180588 ↑ ↑
9. Hellberg, R. (2026): Reconfiguring defence supply chains: procurement dynamics, inter-organizational dependence, and resilience under geopolitical uncertainty. Defence and Peace Economics, online first, 1–40. doi.org/10.1080/10242694.2026.2655381 ↑ ↑ ↑ ↑ ↑ ↑
10. Urmston, A.; Song, D.; Lyons, A. (2024): The Development of Risk Assessments and Supplier Resilience Models for Military Industrial Supply Chains Considering Rare Disruptions. Logistics, 8(2), 57. doi.org/10.3390/logistics8020057 ↑ ↑
11. Berger, R.; Wagner, R.; Dion, P. M.; Matthias, O. (2025): Disrupting disruptions: enhancing supply chain resilience – lessons from the US Air Force. Annals of Operations Research, 347(3), 1163–1192. doi.org/10.1007/s10479-025-06527-6 ↑
12. ISO 22301:2019 – Security and resilience – Business continuity management systems – Requirements. Available for purchase through standards trade. iso.org ↑ ↑ ↑ ↑
13. ISO/TS 22318:2021 – Security and resilience – Business continuity management systems – Guidelines for supply chain continuity management. Available for purchase through standards trade. iso.org ↑ ↑ ↑ ↑
14. Galaitsi, S. E.; Pinigina, E.; Keisler, J. M.; Pescaroli, G.; Keenan, J. M.; Linkov, I. (2023): Business Continuity Management, Operational Resilience, and Organizational Resilience: Commonalities, Distinctions, and Synthesis. International Journal of Disaster Risk Science, 14, 713–721. doi.org/10.1007/s13753-023-00494-x ↑
15. Loyarte, E.; Gurrutxaga, N.; Funcia, J. (2024): Continuity Governance model: a new process stage in the BCM system that underpins organizational resilience. Cogent Business & Management, 11(1), 2434731. doi.org/10.1080/23311975.2024.2434731 ↑
16. Riglietti, G.; Avatefipour, A.; Trucco, P. (2021): The impact of business continuity management on the components of supply chain resilience: A quantitative analysis. Journal of Business Continuity & Emergency Planning, 15(2), 182–195. pubmed.ncbi.nlm.nih.gov ↑
17. Azadegan, A.; Syed, T. A.; Blome, C.; Tajeddini, K. (2020): Supply chain involvement in business continuity management: effects on reputational and operational damage containment from supply chain disruptions. Supply Chain Management: An International Journal, 25(6), 747–772. doi.org/10.1108/SCM-08-2019-0304 ↑
18. Cabrera, B.; Santa, R.; Tegethoff, T.; Morante, D.; Ferrer, M. (2023): Supply chain resilience in the Colombian defense sector before and during the COVID-19 pandemic: A comparative study. PLOS ONE, 18(3), e0282793. doi.org/10.1371/journal.pone.0282793 ↑