In relation to Business Continuity (BC) validation, where product or service delivery is outsourced, which...

CBCI 7.0 (via GPG 7.0) treats Validation (PP6) as confirming that the BCMS and its components can meet continuity objectives—including where dependencies sit outside the organization. When delivery is outsourced, validation must extend to supplier capability, because supplier failure can prevent the organization from meeting its own product/service commitments.

A practical good-practice control is to formalize expectations contractually through an SLA. In GPG 7.0 terminology, an SLA is an agreed commitment between provider and client that includes responsibilities and continuity capabilities. Requiring the supplier to carry out exercises (and share evidence/outputs) is a direct way to validate that continuity arrangements are not just documented but can be performed. This aligns with BCI guidance that SLAs/contractual terms should oblige suppliers to support your incident-time objectives and resilience requirements.

Option A is inappropriate because your organization generally cannot “own” and run a supplier’s internal exercise programme; you can require and verify outcomes, but not assume their accountability. Option D is a common failure mode—outsourcing the service does not outsource your responsibility to manage continuity risk. Option B (replacement services) can be part of strategy, but it does not replace the need to validate the current supplier’s continuity capability.