--- title: "Proving It: How to Respond to Customer Requests for Evidence of Resilience" description: Learn what business continuity evidence customers may request, what to share, and how to demonstrate resilience without exposing sensitive details. image: https://46330580.fs1.hubspotusercontent-na1.net/hubfs/46330580/Corporate%20Reports%20and%20Confidential%20Files.png --- [Skip to content](https://mha-it.com/blog/business-continuity-evidence-requests#main-content) [![MHA by BCMMetrics - navy](https://46330580.fs1.hubspotusercontent-na1.net/hub/46330580/hubfs/MHA%20by%20BCMMetrics%20-%20navy.png?width=245&height=54&name=MHA%20by%20BCMMetrics%20-%20navy.png "MHA by BCMMetrics - navy")](https://mha-it.com/) - [Our Consulting Services](https://mha-it.com/what-we-do) - [Business Continuity](https://mha-it.com/business-continuity) - [Crisis Management](https://mha-it.com/crisis-management) - [Disaster Recovery](https://mha-it.com/disaster-recovery-consulting-services) - [BCaaS](https://mha-it.com/bcaas) - [Program Augmentation](https://mha-it.com/program-augmentation) - [Training and Awareness](https://mha-it.com/training-awareness) - [Our BC Software](https://bcmmetrics.com/) - Resources - [Blog](https://mha-it.com/blog) - [News](https://mha-it.com/news) - [About Us](https://mha-it.com/who-we-are) - [Our Team](https://mha-it.com/our-team) - [Clients](https://mha-it.com/clients) - [In the Community](https://mha-it.com/in-the-community) [Contact Us](https://mha-it.com/contact) [![mhalogo](https://mha-it.com/hubfs/mhalogo.svg "mhalogo")](https://mha-it.com/) [Contact Us](https://mha-it.com/contact) [![mhalogo](https://mha-it.com/hubfs/mhalogo.svg "mhalogo")](https://mha-it.com/) - [Our Consulting Services](https://mha-it.com/what-we-do) - [Business Continuity](https://mha-it.com/business-continuity) - [Crisis Management](https://mha-it.com/crisis-management) - [Disaster Recovery](https://mha-it.com/disaster-recovery-consulting-services) - [BCaaS](https://mha-it.com/bcaas) - [Program Augmentation](https://mha-it.com/program-augmentation) - [Training and Awareness](https://mha-it.com/training-awareness) - [Our BC Software](https://bcmmetrics.com/) - Resources - [Blog](https://mha-it.com/blog) - [News](https://mha-it.com/news) - [About Us](https://mha-it.com/who-we-are) - [Our Team](https://mha-it.com/our-team) - [Clients](https://mha-it.com/clients) - [In the Community](https://mha-it.com/in-the-community) [Contact Us](https://mha-it.com/contact) [![mhalogo](https://mha-it.com/hubfs/mhalogo.svg "mhalogo")](https://mha-it.com/) [Contact Us](https://mha-it.com/contact) - [Our Consulting Services](https://mha-it.com/what-we-do) - [Business Continuity](https://mha-it.com/business-continuity) - [Crisis Management](https://mha-it.com/crisis-management) - [Disaster Recovery](https://mha-it.com/disaster-recovery-consulting-services) - [BCaaS](https://mha-it.com/bcaas) - [Program Augmentation](https://mha-it.com/program-augmentation) - [Training and Awareness](https://mha-it.com/training-awareness) - [Our BC Software](https://bcmmetrics.com/) - Resources - [Blog](https://mha-it.com/blog) - [News](https://mha-it.com/news) - [About Us](https://mha-it.com/who-we-are) - [Our Team](https://mha-it.com/our-team) - [Clients](https://mha-it.com/clients) - [In the Community](https://mha-it.com/in-the-community) [Contact Us](https://mha-it.com/contact) Business Continuity Planning # Proving It: How to Respond to Customer Requests for Evidence of Resilience Richard Long Published on: November 03, 2026 #### Relevant Contents #### Need Tailored Business Continuity Insights? Contact Us Now for Personalized Guidance! [Schedule a Free Consultation](https://mha-it.com/contact) Companies are increasingly asking their partners and suppliers to demonstrate that they have the ability to take a hit and keep on functioning. Organizations on the receiving end of these requests should be ready to promptly supply three types of business continuity documentation while striking a balance between transparency and protecting their proprietary information.**Related:** [The BC Audit Survival Guide: 12 Tips to Help You Navigate Your Next Compliance Audit](https://mha-it.com/blog/bc-compliance-audit-checklist) **Summary** - Customer, partner, auditor, and regulatory requests for proof of business continuity and IT/DR readiness are becoming more common. - Organizations should prepare credible external-facing documentation in advance rather than rely on generic materials or disclose sensitive internal plans. - Three useful document types are a program overview, a summary of recovery strategies and preparations, and summaries of exercise results. ## A Growing Demand for Proof of Resilience We’ve written a lot in our blogs about how organizations need to identify and vet their critical suppliers to ensure they are not blindsided by the loss of a vendor whose product or service is essential to their operations. Today, we’re going to look at this issue from the other side: what if one of your customers, in the course of vetting its supply chain or critical third party services, asks your organization to provide documentation about its business continuity program? Such requests, which often come in the form of questionnaires to be filled out, may arrive during a sales process, as part of a contract renewal, or during a supplier review. Whatever the form or circumstances, requests that providers document their continuity capability are more frequent, a development we at MHA welcome. Everyone benefits when the overall level of organizational resilience in society is increased. And customers aren’t the only ones who are showing a rising interest in obtaining proof of resilience. Partners, boards, regulatory agencies, and auditors are increasingly asking the organizations they work with or oversee to provide proof of readiness in business continuity (BC) and IT disaster recovery (IT/DR). [![BCMMETRICS COMPLIANCE CONFIDENCE](https://no-cache.hubspot.com/cta/default/46330580/interactive-225945463043.png)](https://mha-it.com/hs/cta/wi/redirect?encryptedPayload=AVxigLLbQgtqOqPl%2B7%2FeeH3Iat4XjAgMeAvb3fB7YRrUTrOEQ9gPkKes4OITiM9ZzK89%2BT%2BS%2FAw64un3wDWdg7snhg15SK2V4Scey9jrmjoITnfl0DpJ8Vtle4XGOiks28Nny4%2FFeIgU4nmPens17QQHcqcMwjmIpx7xgWOYpZXixH%2FOdxbB7bpTGkLwvz74SCI%3D&webInteractiveContentId=225945463043&portalId=46330580) ## Three Principles for Responding to Customer Requests Before we get into the details of exactly what kind of documentation you should be prepared to provide, there are three overarching considerations to be aware of: ### Promptness Counts Being able to respond promptly, with well-prepared materials that address the customer’s questions, demonstrates that business continuity is an established part of your organization’s operations rather than an afterthought. In some cases, the ability to provide this information quickly could make a difference in whether a customer chooses to do business with you. ### Generic Material Won’t Cut It Your documentation should describe the arrangements your organization has actually put in place and provide credible evidence that they work. A generic policy or template taken from the internet or generated by AI does not demonstrate that you have developed recovery strategies suited to your operations, tested your capabilities, or established appropriate program oversight. ### You Need to Balance Transparency With Discretion Customers have legitimate reasons to want assurance that a critical supplier can continue operating or recover from a disruption. But that doesn’t mean you should hand over your internal business continuity or disaster recovery plans. These documents may contain proprietary information about your systems, facilities, recovery procedures, security measures, and other vulnerabilities. Instead, as explained in the next section, prepare external-facing materials that explain your capabilities at an appropriate level of detail. The key is to prepare for these requests before they arrive, rather than scrambling to assemble answers under a deadline. By maintaining credible, external-facing documentation, your organization can demonstrate its commitment to resilience while protecting the sensitive details of its internal arrangements. [![EVIDENCE PACKAGE](https://no-cache.hubspot.com/cta/default/46330580/interactive-225940694438.png)](https://mha-it.com/hs/cta/wi/redirect?encryptedPayload=AVxigLLQk7VRkOJUrpskI39iHK5rAm9wOWVVbW3ZopfzVetqP2UC5HI4AKi6d1qhBeJKwdq0t4c%2BimCD%2BR32rRXthKFcIBovqf57LkhyP5wAy7knNtwdEZSzJXx92mORtTfYYaC86s0yYK5e7Ydivfl0AZoOvMw0MN%2BOiH3Eb5%2F6Mmx5BGLocWKqjTJkomvIi61gt78%3D&webInteractiveContentId=225940694438&portalId=46330580) ## Three Types of Documentation to Have Ready We recommend that organizations prepare three types of external-facing documentation to respond to customer requests for proof of continuity and IT/DR capability. Together, these materials can demonstrate that your organization takes continuity seriously, has made appropriate preparations, and tests its ability to recover. ### 1. An Overview of Your Business Continuity Program Start with a document explaining how your BC and IT/DR program is organized and overseen. For example, you might state that designated personnel oversee the maintenance and testing of business continuity and disaster recovery arrangements, that a steering committee regularly reviews the program’s status and directs improvements, and that crisis management and communications responsibilities have been defined. Also provide a high-level description of your exercise program, explaining how frequently you conduct exercises and of what type they are. ### 2. Documentation of Your Recovery Strategies and Preparations Next, prepare an external-facing document that explains how your organization intends to maintain or restore important operations when normal business processes are disrupted. This document should provide a meaningful, nonproprietary summary of the strategies you have developed and the preparations you have made to implement them. For example, you might explain that employees are cross-trained to maintain critical functions when key personnel are unavailable and that manual procedures have been established to support functions such as payroll, sales, or distribution if normal systems cannot be used. Your IT/DR summary might describe how data and processing capabilities are protected through multiple locations and recovery arrangements appropriate to your recovery time and recovery point objectives. Do not identify technologies, reveal system configurations, or describe security controls in enough detail to expose potential vulnerabilities. ### 3. Summaries of Exercise Results Finally, prepare external-facing summaries of your business continuity and disaster recovery exercises. These summaries should identify the exercise’s purpose and scope, describe the capabilities or procedures tested, and report the results at an appropriate level of detail. For example, a summary might describe a tabletop exercise in which the crisis management team worked through a major facility outage, or a disaster recovery test that evaluated the restoration of critical applications. The summaries should convey what the exercise demonstrated and whether the arrangements performed as expected. Where appropriate, they can note that improvement opportunities were identified and that follow-up actions were assigned or completed. They should not, however, reproduce detailed internal findings, sensitive technical information, or step-by-step remediation procedures. These three types of documentation can satisfy customers’ legitimate need for assurance that your organization is prepared to withstand and recover from disruptions while protecting confidential information about your internal operations and recovery arrangements. By keeping these documents current as your program evolves, your organization can respond promptly and confidently to future requests. ## Be Ready to Demonstrate Your Resilience Customer requests for evidence of resilience are becoming a routine part of doing business, and organizations should be prepared to respond promptly and credibly. Having an overview of your business continuity program, a summary of your recovery strategies, and documentation of exercise results ready to share can demonstrate that your organization has made meaningful preparations and regularly tests its ability to recover. At the same time, providing assurance does not mean disclosing your internal plans, proprietary information, or sensitive security details. The goal is to give customers a clear picture of your capabilities while protecting information that could expose vulnerabilities or create unnecessary risk. At MHA Consulting, we have extensive experience helping organizations respond to requests for evidence of resilience while striking the right balance between completeness and discretion. Get in touch to learn how MHA can help your organization document its recovery capabilities and respond confidently to customer requests for evidence of resilience. ## Further Reading - [Managing Third-Party Risk: How to Vet Your Critical Suppliers](https://mha-it.com/blog/third-party-risk-critical-suppliers) - [Trust, But Verify: 7 Best Practices for Managing Vendor Risk](https://mha-it.com/blog/best-practices-third-party-risk-management) - [The BC Audit Survival Guide: 12 Tips to Help You Navigate Your Next Compliance Audit](https://mha-it.com/blog/bc-compliance-audit-checklist) - [The Devil Is in the Details: How Small Oversights Can Derail Your Recovery](https://mha-it.com/blog/business-continuity-recovery-strategy-details) - [In the Era of Rogue AI, Recoverability Matters More Than Ever](https://mha-it.com/blog/ai-cyber-threats-business-continuity-recoverability) ## Frequently Asked Questions ### Why are customers asking suppliers for evidence of resilience? Organizations increasingly want assurance that critical suppliers can maintain operations or recover from disruptions. These requests often arise during sales processes, contract renewals, or supplier reviews, and may take the form of questionnaires. ### How should an organization respond to requests for evidence of resilience? Respond promptly with documentation that reflects your actual capabilities, not generic templates. Provide enough detail to establish credibility while protecting confidential information and avoiding disclosure of sensitive internal plans. ### What should an overview of a business continuity program include? It should describe program governance and responsibilities, including who oversees continuity and disaster recovery arrangements, how leadership reviews the program, and how crisis management and communications responsibilities are defined. It should also summarize the organization’s exercise program. ### What should documentation of recovery strategies and preparations cover? It should summarize how the organization plans to maintain critical business processes and restore IT systems during a disruption. Possible examples include cross-training employees, establishing manual workarounds, and describing recovery arrangements without revealing sensitive technologies, configurations, or security controls. ### What should summaries of business continuity and disaster recovery exercises contain? They should describe each exercise’s purpose and scope, the capabilities tested, and the results. They can also summarize improvement opportunities and follow-up actions, while keeping sensitive technical findings and detailed remediation procedures in internal reports. --- ![](https://mha-it.com/hubfs/Richard%20Long-MHA-Consulting.png) #### Richard Long Richard Long is one of MHA’s practice team leaders for Technology and Disaster Recovery related engagements. He has been responsible for the successful execution of MHA business continuity and disaster recovery engagements in industries such as Energy & Utilities, Government Services, Healthcare, Insurance, Risk Management, Travel & Entertainment, Consumer Products, and Education. Prior to joining MHA, Richard held Senior IT Director positions at PetSmart (NASDAQ: PETM) and Avnet, Inc. (NYSE: AVT) and has been a senior leader across all disciplines of IT. He has successfully led international and domestic disaster recovery, technology assessment, crisis management and risk mitigation engagements. ## Start building a stronger future ##### Navigate uncertainty with an expert - schedule your free consultation with our CEO, Michael Herrera. [Schedule your consultation](https://mha-it.com/contact) ## Other resources you might enjoy ![Business continuity team comparing inherent and residual risk](https://46330580.fs1.hubspotusercontent-na1.net/hub/46330580/hubfs/Imported_Blog_Media/inherent-risk.jpg?height=245&name=inherent-risk.jpg) #### [Inherent Risk vs. Residual Risk Explained | MHA Consulting](https://mha-it.com/blog/inherent-risk-vs-residual-risk) [Read More](https://mha-it.com/blog/inherent-risk-vs-residual-risk) ![](https://46330580.fs1.hubspotusercontent-na1.net/hub/46330580/hubfs/Blog%20images/5%20Fusion%20Risk%20Management%20Alternatives%20for%20Business%20Continuity%20(1).webp?height=245&name=5%20Fusion%20Risk%20Management%20Alternatives%20for%20Business%20Continuity%20(1).webp) #### [Choosing the Right Resilience Consultant: 14 Essential Tips](https://mha-it.com/blog/business-resilience-consultant) [Read More](https://mha-it.com/blog/business-resilience-consultant) ![Back in the Saddle: Resuming Regular BCM Activities](https://46330580.fs1.hubspotusercontent-na1.net/hub/46330580/hubfs/Imported_Blog_Media/resuming-regular-bcm-activities.jpg?height=245&name=resuming-regular-bcm-activities.jpg) #### [Back in the Saddle: Resuming Regular BCM Activities - MHA Consulting](https://mha-it.com/blog/resuming-regular-bcm-activities) [Read More](https://mha-it.com/blog/resuming-regular-bcm-activities) ## Ready to start focusing on higher-level challenges? [![MHA by BCMMetrics - White](https://46330580.fs1.hubspotusercontent-na1.net/hub/46330580/hubfs/MHA%20by%20BCMMetrics%20-%20White.png?width=308&height=68&name=MHA%20by%20BCMMetrics%20-%20White.png "MHA by BCMMetrics - White")](https://mha-it.com/) Business continuity consulting for today’s leading companies. #### Company - [Who We Are](https://mha-it.com/who-we-are) - [Team](https://mha-it.com/our-team) - [Clients](https://mha-it.com/clients) - [News](https://mha-it.com/news) - [Blog](https://mha-it.com/blog) - [Contact](https://mha-it.com/contact) #### Services - [Business Continuity](https://mha-it.com/business-continuity) - [Disaster Recovery](https://mha-it.com/disaster-recovery-consulting-services) - [Crisis Management](https://mha-it.com/crisis-management) - [BCaaS](https://mha-it.com/bcaas) - [Training & Awareness](https://mha-it.com/training-awareness) - [Program Augmentation](https://mha-it.com/program-augmentation) © 2026 MHA Consulting. All rights reserved.  [Privacy Policy](https://mha-it.com/privacy-policy) ```json { "@context" : "", "@type" : "BreadcrumbList", "itemListElement" : [ { "@type" : "ListItem", "item" : "https://mha-it.com", "name" : "Home", "position" : 1 }, { "@type" : "ListItem", "item" : "https://mha-it.com/blog", "name" : "Blog", "position" : 2 }, { "@type" : "ListItem", "name" : "Proving It: How to Respond to Customer Requests for Evidence of Resilience", "position" : 3 } ] } ``` ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Richard Long", "url" : "https://mha-it.com/blog/author/richard-long" }, "dateModified" : "2026-11-03T15:00:02.139Z", "datePublished" : "2026-11-03T15:00:02.000Z", "headline" : "Proving It: How to Respond to Customer Requests for Evidence of Resilience", "image" : [ "https://46330580.fs1.hubspotusercontent-na1.net/hubfs/46330580/Corporate%20Reports%20and%20Confidential%20Files.png" ], "mainEntityOfPage" : { "@id" : "https://mha-it.com/blog/business-continuity-evidence-requests", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://mha-it.com/hubfs/Frame%2016353%20(1).svg" } } } ```