Risk, Security and Resilience

Introduction

Global supply chains connect suppliers, factories, logistics providers, ports, digital platforms, financial institutions and customers across multiple jurisdictions. This interdependence creates efficiency and scale, but it also transmits disruption. A cyberattack on a freight-management platform, drought affecting a canal, sanctions imposed on a trading partner or the failure of a specialized sub-tier supplier can interrupt an entire network.

Supply-chain risk management is therefore not simply emergency response. It is the coordinated process of identifying uncertainty, assessing exposure, selecting controls, preparing continuity arrangements and learning from disruptions. Security protects goods, people, facilities, information and systems against intentional harm. Resilience is the capacity to prepare for, absorb, respond to and recover from disruption while adapting to changed conditions.

Efficiency and resilience are not necessarily opposites. Inventory, redundant capacity and alternative routes can increase cost, but poorly designed disruption safeguards may threaten revenue, safety, compliance and corporate survival. The managerial task is to select proportionate capabilities based on criticality and risk appetite.

Learning Objectives

After studying this chapter, students should be able to:

1. Distinguish operational, supplier, cyber, climate, geopolitical, security and systemic risks.
2. Map risk across multi-tier global supply networks.
3. Apply qualitative and quantitative risk-assessment methods appropriately.
4. Explain business continuity, redundancy, flexibility, visibility and collaboration.
5. Use time-to-survive, time-to-recover and service-loss measures.
6. Design and interpret supply-chain stress tests.
7. Evaluate governance, ethical and regulatory responsibilities.
8. Recommend a balanced resilience strategy for a global network.

1. The Nature of Supply-Chain Risk

1.1 Risk, uncertainty, vulnerability and disruption

A risk is an uncertain event or condition that can affect objectives. It involves possible consequences and some basis—however incomplete—for assessing likelihood. Uncertainty is broader and may include situations in which events, causal relationships or probabilities are poorly known.

A hazard is a potential source of harm, such as flooding or malware. Exposure concerns the people, assets, processes or flows located where the hazard can affect them. Vulnerability is the susceptibility of those exposed elements to damage. A disruption occurs when the event materially impairs operations or service.

A useful conceptual relationship is:

This is a conceptual function, not a universal multiplication formula. The variables may be measured on incompatible scales, and dependence among them must be considered.

1.2 Robustness, resilience and agility

These related capabilities solve different problems:

• Robustness is the ability to withstand a specified disturbance with little performance loss.
• Resilience includes absorption, recovery and adaptation after performance deteriorates.
• Agility is the ability to respond rapidly to changing demand or supply conditions.
• Adaptability is the ability to redesign structures and strategies as conditions evolve.

A reinforced warehouse may be robust against a known wind speed. A network that reroutes orders, reallocates inventory and learns from the incident is resilient. A firm that quickly changes product mix is agile. A firm that relocates sourcing because climate patterns have permanently shifted is adapting.

1.3 Efficiency can create hidden fragility

Lean production, geographic specialization, high asset utilization and low inventory can improve normal-period performance. However, they may also create tightly coupled networks with limited recovery margins. A low-cost supplier is not economically superior if its failure causes losses exceeding the savings it generated.

Resilience decisions should therefore consider total risk-adjusted cost, including prevention expenditure, expected disruption loss, recovery costs, lost contribution, penalties and reputational harm. Not all risks can be monetized reliably; safety, human rights and legal obligations may impose non-negotiable constraints.

2. A Taxonomy of Global Supply-Chain Risks

Risk categories interact. For example, geopolitical conflict may trigger sanctions, cyberattacks, energy shortages, route closures and supplier insolvency. Treating each risk in isolation may underestimate systemic exposure.

2.1 Operational and supplier risk

Operational risks arise within routine processes but can generate major consequences when capacity is concentrated. Relevant indicators include defect rates, capacity utilization, overdue maintenance, employee turnover, lead-time variability and inventory accuracy.

Supplier risk includes financial weakness, poor quality, limited capacity, unethical practices and dependence on the supplier’s own sub-tier network. Purchasing records usually identify direct or tier-one suppliers, but critical dependencies may lie at tiers two, three or beyond. Several tier-one suppliers may secretly depend on the same semiconductor fabrication plant, mine or cloud provider.

2.2 Cyber risk as operational risk

Modern logistics depends on enterprise resource planning, warehouse-management, transport-management, customs and industrial-control systems. Cyber incidents can therefore create physical consequences. A compromised account can redirect payments or cargo; ransomware can stop dispatching; manipulated sensor data can conceal temperature excursions.

Cyber resilience requires more than perimeter protection. Relevant controls include multifactor authentication, least-privilege access, network segmentation, patch management, encrypted and tested backups, supplier-access controls, logging, staff awareness and rehearsed incident response. Operational technology may require carefully scheduled patching because an uncontrolled update can itself interrupt production.

2.3 Climate risk

Climate risk has two major forms:

• Physical risk: acute events such as storms and floods, and chronic changes such as rising temperatures, water scarcity and sea-level rise.
• Transition risk: policy, technology, market and reputational changes associated with movement toward a lower-carbon economy.

Historical averages may understate future physical risk when climate conditions are non-stationary. Firms should combine site-level hazard information with supplier locations, transport corridors, water and energy dependence, asset design and recovery capability.

2.4 Geopolitical and systemic risk

Geopolitical exposure includes conflict, sanctions, tariffs, export licensing, local-content rules and political interference. Country diversification does not guarantee independence: two countries may rely on the same maritime chokepoint or upstream source.

A systemic risk affects many nodes simultaneously or propagates through network relationships. Pandemics, global software vulnerabilities and financial crises cannot be addressed by local inventory alone. They require portfolio-level analysis, external coordination and adaptive decision rights.

3. Mapping the Network and Its Risks

A firm cannot manage dependencies it has not identified. Supply-chain mapping records nodes, links, flows and dependencies. A useful map includes:

• supplier, production, warehouse and customer locations;
• product and material flows;
• transport modes, ports and chokepoints;
• lead times, capacities and inventory;
• ownership and contractual relationships;
• information systems and data exchanges;
• tier-two and deeper dependencies;
• substitute materials, facilities and routes;
• critical utilities and service providers.

Figure: A supply-chain map should reveal both visible material flows and shared digital, infrastructure and geographic dependencies.

3.1 Criticality and concentration

Not every item deserves the same level of protection. Criticality can reflect revenue contribution, safety, regulatory necessity, substitutability, lead time and customer impact. A low-cost component may be highly critical if its absence stops an expensive final product.

Supplier concentration may be summarized using a Herfindahl-type index:

Here, s_i is supplier i’s share of the relevant sourcing volume expressed as a decimal, and n is the number of suppliers. The index ranges from 1/n for equal shares across n suppliers to 1 for complete concentration. It measures sourcing concentration, not resilience: suppliers may still share a common upstream dependency.

Example. Shares of 50%, 30% and 20% produce:

The result should be compared with alternative sourcing structures and interpreted alongside switching capability and dependency data.

4. Risk Assessment and Prioritization

4.1 Risk registers and heat maps

A risk register normally records causes, events, consequences, controls, owners, indicators, treatment actions and review dates. A heat map places risks into likelihood and impact categories. It supports communication but has limitations: categories are subjective, ordinal scores are often treated incorrectly as precise quantities, and correlated risks may be hidden.

A three-factor priority score is sometimes used:

L is the likelihood rating, I is the impact rating and D is a detectability or control-gap rating. If detectability is used, the scale must specify that a higher value means poorer detection. These are dimensionless ordinal ratings, not probabilities or monetary losses.

Worked application. A supplier failure receives likelihood 4, impact 5 and detectability 4 on five-point scales:

The score of 80 helps prioritize review within the same calibrated method. It does not mean the risk is twice as severe as one scoring 40.

4.2 Expected loss

Where probabilities and monetary consequences can be estimated consistently, expected loss is:

E(L) is expected loss in currency for the stated period, p_i is the probability of event i during that period, and C_i is its monetary consequence if it occurs. By linearity of expectation, the formula can sum event losses even when events are dependent, provided each event and consequence is defined without double counting. Dependence remains crucial for tail scenarios and required liquidity.

Example. A 10% annual probability of a $500,000 loss and a 25% probability of an $80,000 loss give:

Expected loss is not the maximum loss and should not be the sole basis for low-probability catastrophic decisions.

4.3 Failure mode and effects analysis

Failure mode and effects analysis (FMEA) examines how a process or component may fail, the effects of failure, causes, existing controls and recommended actions. Traditional risk-priority numbers multiply occurrence, severity and detection ratings. Because different rating combinations can produce the same number and the scales are ordinal, managers should examine the underlying dimensions rather than relying only on the product.

4.4 Indicators and escalation

Key risk indicators (KRIs) provide warning of changing exposure. Examples include supplier credit deterioration, late-delivery trends, abnormal login activity, port dwell time, water-reservoir levels and political-violence alerts. A useful indicator has an owner, reliable data, thresholds, escalation procedures and a link to decisions. Excessive alerts can produce warning fatigue.

5. Business Continuity and Recovery

Business continuity management prepares the organization to continue priority activities at acceptable levels. A business impact analysis (BIA) identifies critical processes, resource dependencies and consequences of interruption.

Important time concepts include:

• Maximum tolerable period of disruption: the point beyond which impacts become unacceptable.
• Recovery time objective (RTO): the target time for restoring a process or system.
• Recovery point objective (RPO): the maximum acceptable data loss measured backward in time.
• Time to recover (TTR): the estimated duration required for a disrupted node or process to restore required performance.
• Time to survive (TTS): how long downstream operations can continue before the disruption causes an unacceptable shortfall.

Continuity plans should specify roles, authority, communications, manual workarounds, alternate sites, supplier contacts, data recovery, employee welfare and return-to-normal procedures. A plan that has not been exercised is an unverified assumption.

5.1 Time-to-survive calculation

For a constant-demand special case, if usable buffer inventory is I, demand is D units per period and unaffected supply is S units per period, then:

The units are periods because units divided by units per period equals periods. This approximation assumes constant demand and supply, fully usable inventory, no spoilage, no batch restrictions and no other replenishment. If S ≥ D, inventory does not deplete under these assumptions, so this finite formula does not apply.

For 12,000 usable units, weekly demand of 10,000 and unaffected supply of 4,000:

If the disrupted supplier’s TTR is four weeks, the two-week gap indicates the need for faster recovery, additional inventory or alternative capacity.

6. Resilience Capabilities

6.1 Redundancy

Redundancy duplicates resources: safety stock, backup suppliers, spare capacity, alternative facilities or duplicated data. It can be effective but costly. Nominal dual sourcing is not genuine redundancy when both suppliers rely on the same sub-tier source or port.

If two fully substitutable suppliers are independently available with probabilities A₁ and A₂, and either can meet the full requirement, parallel availability is:

For two suppliers each independently available 90% of the time:

Thus availability is 99%. This result does not apply if failures are correlated, capacity is insufficient or switching is delayed.

6.2 Flexibility

Flexibility creates options without necessarily duplicating complete resources. Examples include multi-skilled labour, interchangeable materials, postponement, modular products, flexible contracts and plants capable of producing multiple items. Flexibility is valuable under diverse disruptions, but it requires prior qualification, tooling, data and decision rules.

6.3 Visibility and traceability

Visibility is timely awareness of inventory, capacity, orders, shipments and risk conditions. Traceability is the ability to follow the history, location and transformation of an item or batch. Control towers, sensors and shared platforms can improve situational awareness, but poor master data and inaccurate supplier reporting create false confidence.

Visibility should lead to action. Knowing that a shipment is delayed has limited value if the firm lacks authority, inventory or transport alternatives.

6.4 Collaboration and relational resilience

Contracts establish rights and responsibilities, but severe disruptions also require communication and joint problem-solving. Collaborative practices include shared forecasts, coordinated continuity planning, supplier-development programmes and pre-agreed allocation rules. Unequal bargaining power can undermine collaboration when dominant buyers transfer excessive cost or risk to vulnerable suppliers.

6.5 Diversification, regionalization and postponement

Geographic diversification reduces dependence only when locations do not share the relevant hazard. Regionalization can shorten lead times and reduce exposure to distant chokepoints, although it may increase costs or create regional concentration. Postponement delays final product differentiation, allowing common inventory to serve multiple markets.

7. Measuring Recovery and Testing Resilience

7.1 Performance loss and recovery

Let q(t) represent delivered service at time t and q₀ represent normal service. Cumulative service loss over horizon H is:

The notation [x]_+ = max(x,0) prevents performance above baseline from being counted as negative loss. If service is measured in units per day, L_H is measured in units.

When 0 ≤ q(t) ≤ q₀ and q₀ > 0, a normalized resilience measure is:

Under these stated conditions, 0 ≤ R_H ≤ 1. A higher value indicates less cumulative service loss over the selected horizon. Results depend on the horizon and service measure, so comparisons require consistent definitions.

7.2 Stress testing

Stress testing asks how the network performs under severe but plausible conditions. It differs from forecasting: the purpose is not to identify the single most likely future but to reveal vulnerabilities and decision needs.

A structured stress test includes:

1. Define scope, critical products and performance thresholds.
2. Specify scenarios, duration and assumptions.
3. Map direct and cascading impacts.
4. Estimate inventory depletion, capacity, cash and recovery times.
5. Identify breached thresholds and critical decision points.
6. test communications and authority through simulations or exercises.
7. Assign improvements and repeat the test.

Useful scenarios include closure of a major port, simultaneous cyber and operational outages, supplier failure during peak demand, prolonged power rationing, export restrictions and correlated flooding across a region. Reverse stress testing begins with an unacceptable outcome—such as inability to supply a life-critical product—and asks what combination of events could cause it.

Scenario models must not imply false precision. Results should disclose assumptions about demand, substitution, transport time, supplier behavior and event dependence.

8. Security, Governance and Regulation

Supply-chain security protects cargo, facilities, personnel, intellectual property and information. Physical controls include access management, secure parking, seals, screening, lighting and incident reporting. Chain-of-custody procedures document possession and transfer, supporting integrity and accountability.

Governance begins with board-approved risk appetite and clear ownership. Procurement, operations, logistics, cybersecurity, finance, compliance and sustainability functions should use shared escalation protocols. Incentives matter: buyers rewarded only for unit-price savings may select fragile suppliers despite enterprise-level risk.

Relevant frameworks may include ISO 31000 for risk-management guidance, ISO 22301 for business continuity, ISO 28000 for security-management systems and the NIST Cybersecurity Framework for cyber-risk management. Customs security programmes such as Authorized Economic Operator arrangements vary by jurisdiction. Certification does not eliminate risk; firms must determine which legal and contractual requirements apply.

Ethical responsibilities include protecting workers during emergencies, avoiding corrupt facilitation, respecting privacy and conducting human-rights due diligence. Traceability technologies should not become instruments of unjustified employee surveillance. Resilience costs should also not be imposed on small suppliers through unrealistic inventories or payment terms.

9. Technology and Artificial Intelligence

Digital twins, graph analytics, satellite observations, Internet of Things sensors and machine learning can support disruption detection and scenario analysis. Graph models are especially useful for identifying central nodes and common dependencies. AI can summarize alerts, estimate likely delays and recommend rerouting.

However, historical data may not represent unprecedented disruptions. Algorithms can reproduce biased supplier assessments or generate opaque recommendations. Automated decisions therefore require data governance, model validation, human oversight, cybersecurity and fallback procedures. A digital resilience platform may itself become a common point of failure.

10. Applied Case: Meridian Medical Devices

This is an illustrative fictional case.

Background

Meridian Medical Devices sells infusion-control units in Europe and Asia. Weekly demand is 10,000 units. A specialized controller from Supplier A provides 60% of requirements; other qualified supply provides 4,000 units per week. Meridian holds 12,000 usable controllers. Supplier A and the alternative supplier appear geographically separate, but both use the same cloud-based production-scheduling provider.

Problem

A cyberattack disables Supplier A’s production and the shared scheduling platform. Initial recovery estimates indicate that Supplier A will require four weeks. Hospitals treat the product as critical, so prolonged shortage carries financial, clinical and reputational consequences.

Analysis

With unaffected supply of 4,000 units and demand of 10,000 units, Meridian consumes inventory at 6,000 units per week. Its time to survive is:

Because TTR is four weeks, the original plan contains a two-week resilience gap. The firm’s apparent dual sourcing also provides limited protection because of the shared digital dependency.

A response team maps available options. A pre-qualified supplier can deliver 3,000 units per week beginning in week three. A Meridian plant can produce 2,000 units per week beginning in week three after emergency tooling. Together with the unaffected 4,000 units, week-three supply would be 9,000 units, leaving a 1,000-unit weekly gap against unchanged demand.

Approach

Meridian adopts four coordinated actions:

1. Allocate available controllers according to clinical criticality rather than customer bargaining power.
2. Activate the pre-qualified supplier and flexible internal line.
3. Reduce weekly requirements by 1,000 units through approved product reconfiguration and deferred non-critical orders.
4. Isolate supplier connections, validate clean backups and introduce an independent scheduling workaround.

For the longer term, Meridian requires disclosure of critical digital sub-processors, conducts joint cyber exercises, introduces two weeks of strategic inventory for the most critical controller and redesigns future products to accept alternative components.

Outcome

Under the revised plan, weeks one and two are covered by unaffected supply plus the 12,000-unit buffer. From week three, 9,000 units of physical supply and a 1,000-unit demand reduction balance the original 10,000-unit requirement. No clinically prioritized order is missed, although non-critical deliveries are deferred and emergency costs rise.

Learning Points

The case demonstrates that supplier count is not equivalent to independence. TTS–TTR comparison reveals the timing of exposure, while flexibility and demand management can complement inventory. Ethical allocation criteria are essential when shortages affect health or safety. Finally, resilience requires attention to digital as well as physical dependencies.

11. Challenges and Managerial Best Practices

Risk analysis is constrained by incomplete tier visibility, strategic supplier reporting, uncertain probabilities and rapidly changing conditions. Excessive buffers can become obsolete, while diversified networks can increase complexity and cyber exposure. Insurance transfers some financial consequences but does not restore customer service or protect reputation.

Effective practice therefore includes:

• prioritize critical products, nodes and dependencies;
• map beyond tier one where consequences justify the effort;
• distinguish nominal alternatives from genuinely independent options;
• compare TTR with TTS and close material gaps;
• combine redundancy with flexibility, visibility and collaboration;
• include cyber, climate and geopolitical factors in sourcing decisions;
• conduct severe, plausible and reverse stress tests;
• predefine decision rights and ethical allocation principles;
• test continuity plans and verify backups;
• monitor KRIs and learn systematically from incidents and near misses.

Resilience is not a one-time project. Networks, regulations, technologies and hazards evolve, so controls and assumptions require periodic reassessment.

Chapter Summary

Global supply-chain risk emerges from the interaction of hazards, exposure, vulnerability and consequence. Operational, supplier, logistics, cyber, climate, geopolitical, security and regulatory risks frequently interact and propagate through shared dependencies.

Risk mapping makes physical, digital and geographic dependencies visible. Heat maps, expected-loss analysis, FMEA, concentration measures and indicators support prioritization, but each has limitations. Business impact analysis, RTO, RPO, TTS and TTR translate exposure into continuity requirements.

Resilience combines robustness, redundancy, flexibility, visibility, collaboration and adaptation. Stress testing evaluates severe scenarios and identifies threshold breaches, cascading effects and decision needs. Effective governance integrates continuity, cybersecurity, compliance, ethics and supplier management. The strategic objective is not to eliminate all risk, but to maintain acceptable performance, recover intelligently and adapt the network without exposing stakeholders to unjustifiable harm.

Key Terms

Adaptability: Ability to redesign structures or strategies in response to lasting change.

Agility: Ability to respond rapidly to changing supply or demand conditions.

Business impact analysis: Assessment of critical activities, dependencies and interruption consequences.

Business continuity: Capability to continue priority activities at acceptable levels during disruption.

Common point of failure: Shared dependency whose failure can disable multiple network elements.

Cyber resilience: Ability to prepare for, withstand, recover from and adapt to cyber incidents.

Exposure: Presence of assets, people or processes where a hazard can affect them.

Failure mode and effects analysis: Structured analysis of possible failures, causes, effects and controls.

Key risk indicator: Metric providing warning of a change in risk exposure.

Recovery point objective: Maximum acceptable amount of data loss measured in time.

Recovery time objective: Target duration for restoring a process or system.

Redundancy: Deliberate duplication of resources or capacity.

Resilience: Capacity to absorb disruption, recover performance and adapt.

Reverse stress testing: Identification of scenarios capable of producing a predefined unacceptable outcome.

Risk appetite: Amount and type of risk an organization is willing to pursue or retain.

Robustness: Ability to withstand a specified disturbance with limited performance loss.

Time to recover: Estimated time needed to restore required performance after disruption.

Time to survive: Duration operations can continue before a disruption creates an unacceptable shortfall.

Traceability: Ability to follow an item’s history, location and transformation.

Vulnerability: Susceptibility of an exposed element to harm.

Review Questions

Short Answer Questions

1. Distinguish a hazard from supply-chain vulnerability.
2. What is the difference between robustness and resilience?
3. Why can dual sourcing fail to provide genuine redundancy?
4. Define recovery time objective and recovery point objective.
5. What is the purpose of a key risk indicator?

Long Answer Questions

1. Explain how operational, cyber and geopolitical risks can interact in a global supply network.
2. Critically evaluate heat maps, expected-loss analysis and FMEA as risk-prioritization tools.
3. Discuss how redundancy, flexibility, visibility and collaboration contribute differently to resilience.
4. Describe the stages of a supply-chain stress test and explain why assumptions must be disclosed.
5. Examine the governance, ethical and regulatory responsibilities associated with supply-chain resilience.

Analytical / Application Questions

1. A firm has 18,000 units of usable inventory, demand of 9,000 units per week and unaffected supply of 6,000 units per week. Calculate TTS and evaluate exposure if TTR is eight weeks.
2. Map the principal physical, digital and geographic dependencies of a product familiar to you. Identify one common point of failure and recommend controls.
3. Design a severe but plausible stress test involving a cyber incident and transport disruption. Specify assumptions, thresholds, indicators and management decisions.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes resilience from robustness?

A. Resilience concerns only insurance, whereas robustness concerns inventory.

B. Resilience includes recovery and adaptation, whereas robustness emphasizes withstanding a specified disturbance.

C. Resilience eliminates uncertainty, whereas robustness measures probability.

D. Resilience applies to cyber risks only, whereas robustness applies to physical risks.

Correct Answer: B. Resilience includes recovery and adaptation, whereas robustness emphasizes withstanding a specified disturbance.

Question 2

A company holds 15,000 usable units. Demand is 8,000 units per week and unaffected supply is 5,000 units per week. Under constant conditions, what is its time to survive?

A. 3 weeks

B. 5 weeks

C. 8 weeks

D. 13 weeks

Correct Answer: B. 5 weeks

Question 3

Supplier shares are 50%, 30% and 20%. What is the sourcing concentration index HHI = ∑s_i²?

A. 0.29

B. 0.34

C. 0.38

D. 1.00

Correct Answer: C. 0.38

Question 4

Which situation most clearly represents a common point of failure?

A. Two suppliers use different materials and different transport routes.

B. Two suppliers charge different prices for the same component.

C. Two suppliers are located in different countries but use the same cloud scheduling provider.

D. A buyer holds inventory at two independently operated warehouses.

Correct Answer: C. Two suppliers are located in different countries but use the same cloud scheduling provider.

Question 5

A risk has likelihood rating 4, impact rating 5 and detectability rating 4. Using Priority score = L × I × D, what is its score?

A. 13

B. 64

C. 80

D. 100

Correct Answer: C. 80

Question 6

An event has a 10% annual probability of causing a $500,000 loss, while another has a 25% probability of causing an $80,000 loss. What is the total expected annual loss, assuming no double counting?

A. $50,000

B. $70,000

C. $125,000

D. $580,000

Correct Answer: B. $70,000

Question 7

Two fully substitutable suppliers can each meet all demand and have independent availability of 90%. What is their parallel availability?

A. 81%

B. 90%

C. 95%

D. 99%

Correct Answer: D. 99%

Question 8

Which measure specifies the maximum acceptable amount of data loss expressed as time?

A. Recovery point objective

B. Recovery time objective

C. Time to survive

D. Maximum tolerable inventory

Correct Answer: A. Recovery point objective

Question 9

What is the primary purpose of reverse stress testing?

A. To estimate only the most probable disruption

B. To identify event combinations capable of producing a predefined unacceptable outcome

C. To calculate historical average transport cost

D. To replace continuity exercises with forecasts

Correct Answer: B. To identify event combinations capable of producing a predefined unacceptable outcome

Question 10

Which action best demonstrates supply-chain flexibility rather than pure redundancy?

A. Holding an identical spare machine that remains unused

B. Purchasing insurance against cargo loss

C. Designing a production line to use several pre-qualified materials

D. Duplicating the same database in the same vulnerable facility

Correct Answer: C. Designing a production line to use several pre-qualified materials