--- title: "Has any service provider with access to Applicant's network sustained outage longer than 4 hours?" url: https://insuranceposture.com/questions/third-parties/service-provider-access-applicant-s-network-sustained-outage-longer category: "Third parties and vendors" canonical_key: q_ven_005 evidence_state: attested updated: 2026-08-24 --- # Has any service provider with access to Applicant's network sustained outage longer than 4 hours? URL: https://insuranceposture.com/questions/third-parties/service-provider-access-applicant-s-network-sustained-outage-longer Section: Third parties and vendors Evidence state: Attested, not tenant-verifiable Contingent business interruption covers your loss when someone else goes down. This question is how the carrier sizes that exposure. ## What the carrier is actually asking The carrier is asking whether any provider with access to your network, or on which you depend, has suffered a significant outage. It is looking at your dependency concentration and your history of being affected by it. ## Why it is underwritten Contingent business interruption is a growing part of cyber cover and a growing part of cyber loss, because so many organisations depend on the same small set of platforms. A carrier assessing aggregate exposure wants to know which providers you depend on and how you have fared when they failed. ## Where the answer lives in Microsoft 365, Entra ID, and Azure Vendor outage history comes from your records and theirs, so this is attested. Your dependency map is the more useful artefact. | Platform | Where the setting lives | What has to be true | | --- | --- | --- | | Operations records | Incidents caused by third-party outages, with duration and impact | Actual events with business impact recorded. Attested | | Vendor register | Critical dependencies and what fails if each is unavailable | A dependency map, which is what makes the forward-looking half of the answer credible | | Contracts | Service level agreements and their remedies | What the vendor owes you, which is usually service credits rather than compensation for your loss | | Continuity plan | Workarounds for critical vendor unavailability | Documented alternatives, since the response to a vendor outage is entirely procedural | | Provider records | Published incident reports from your major providers | The provider record, which is public for most major platforms and easy to reconcile against your own | **Service credits are not indemnity** A service level agreement typically returns a fraction of your monthly fee. It does not compensate for a day of lost trading. That gap is precisely what contingent business interruption cover exists to fill, which is why the carrier is asking about the dependency rather than about the contract. ## What a defensible yes requires - Vendor-caused outages are disclosed with duration and business impact. - A dependency map identifies which providers are critical and what fails without them. - Continuity plans include vendor unavailability, not only your own systems. - Concentration is understood, including where several vendors depend on the same underlying platform. - What changed after each outage is recorded. ## How this answer goes wrong Only providers with network access are considered, so a day-long outage at the software-as-a-service platform that runs a core business process is omitted. The question is about dependency, and that platform is the dependency most likely to produce a contingent claim. ## If this answer turns out to be wrong When the loss originates at a vendor, the application answers about that vendor are the first document the adjuster reads. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [how an application answer ends in a denied claim](https://insuranceposture.com/glossary/claim-denial). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary). ## Frequently asked ### Do cloud provider outages count? Yes, if they affected you. They are also the most likely source of a contingent claim, so disclosing them accurately helps the cover match the risk. ### What about a vendor breach rather than an outage? Usually captured by the prior incident question rather than this one. Disclose it in whichever place fits, and do not let the distinction cause an omission. ### How do we assess concentration? Map your critical vendors to their underlying infrastructure. Several independent-looking suppliers frequently run on the same platform, which turns one outage into several. ### Does this affect contingent cover? Directly. Carriers may name specific dependencies or apply sub-limits, and an accurate dependency picture is what makes that structure correct. ## Related questions - [Has the Applicant experienced any partial or total network interruption lasting more than 8 hours?](https://insuranceposture.com/questions/incident-response/applicant-experienced-partial-total-network-interruption-lasting-more-than) - [Does the Applicant use a cloud provider, and which provider stores the largest quantity of sensitive records?](https://insuranceposture.com/questions/third-parties/applicant-cloud-provider-provider-stores-largest-quantity-sensitive-records) - [Does the Applicant have a written Business Continuity Plan / Disaster Recovery Plan, tested annually?](https://insuranceposture.com/questions/incident-response/applicant-written-business-continuity-plan-disaster-recovery-plan-tested) - [Does the Applicant review and audit information security/privacy controls of IT, cloud, and non-IT service providers?](https://insuranceposture.com/questions/third-parties/applicant-review-audit-information-security-privacy-controls-cloud-non) --- Insurance Posture by SecValley. https://insuranceposture.com The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished. SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact. Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.