From NFPA – Supplier resilience also depends on industrial risk prevention

Supplier resilience does not depend solely on cybersecurity, financial stability, or stated business continuity plans. It also depends on the physical security of the facilities and warehouses through which production, storage, and distribution take place.

The NFPA does not address third-party risk management as a separate discipline. However, its contribution to the topic of the supply chain is far from marginal.

When an organization evaluates a critical supplier, it often tends to focus on cybersecurity, financial stability, regulatory compliance, and stated business continuity.

In contrast, less attention is paid to the physical characteristics of the sites on which production, storage, and distribution depend.

A fire at a factory or warehouse can disrupt a supply chain for months. If the site houses components that cannot be replaced, strategic inventory, or production capacity that is difficult to replicate, the problem affects more than just the affected supplier. It spreads to the customers who depend on that hub.

Industrial risk prevention—and fire protection in particular—should therefore be considered an essential component of third-party risk management.

Automated Warehouses: Efficiency and Risk Concentration

In 2026, the NFPA’s Fire Protection Research Foundation published the report *Landscape Analysis of Automatic Storage & Retrieval Systems and Fire Protection Guidance*.

ASRS are automated storage and retrieval systems in which robots, shuttles, and other equipment move goods within high-density facilities.

They help increase speed, precision, and storage capacity while reducing the space required.

However, the very features that improve efficiency can also increase the complexity of fire protection.

The report highlights, among other factors:

• the high density and height of the storage system;
• the narrow spaces between the units;
• the presence of proprietary containers and configurations;
• the use of equipment powered by lithium-ion batteries;
• difficulties in gaining access for firefighters;
• the lack of fire safety data available to designers.

A significant portion of the available experimental data is proprietary or pertains to specific ASRS configurations. This limits the ability to develop safety criteria that can be uniformly applied to systems manufactured by different operators.

The 2025 edition of NFPA 13 does not contain specific installation and design criteria for sprinkler systems intended for various ASRS configurations.

The report then identifies the knowledge gaps and the research agenda needed to support the development of criteria for the 2028 edition.

The traditional rules developed for storage on conventional racking systems may prove inadequate when the geometry, clearances, arrangement of goods, and the potential for water to reach the point of fire change.

The document identifies several areas that require further study:

• system design;
• criteria for sprinkler protection;
• procedures for shutting down and securing equipment;
• accessibility for first responders;
• advance planning of the procedure;
• collection and sharing of data from tests and incidents.

Because it’s a matter of supply chain risk

An automated warehouse can be much more than just a building where goods are stored.

It can serve as the single hub from which shipments to multiple plants, customers, or geographic areas are dispatched. It may hold inventory that is difficult to redistribute and use proprietary technologies that take a long time to replace.

Higher density makes it possible to concentrate large amounts of value in a limited space, but it also increases the potential impact of a single event.

For those who manage third-party risk, the point is clear: simply knowing that a supplier has a Business Continuity Plan is not enough.

At the very least, we need to understand:

• which sites the supply comes from;
• if production and inventory are concentrated in a single location;
• what fire protection systems are in place;
• whether the storage configuration is consistent with the sprinkler system’s design criteria;
• how changes to goods, containers, heights, and storage methods are handled;
• whether there are any alternative sites or reserves that can actually be used;
• How long would it take to restore the property after a major fire?

This information cannot be obtained from a standard cyber questionnaire. It requires expertise in property risk engineering, technical assessments, and—for the most critical dependencies—on-site inspections at suppliers’ facilities.

The Relationship to NFPA 1600 and NFPA 1660

The physical aspect of risk must then be linked to business continuity.

The content previously published as NFPA 1600 is now incorporated into Chapters 4–10 of NFPA 1660:2024, the current NFPA standard for emergency, continuity, and crisis management.

NFPA 1660 requires that risk assessments, business impact analyses, and continuity planning take into account the external resources and dependencies necessary for the organization.

The supply chain is therefore not treated merely as a list of suppliers, but as part of the ability to maintain and restore products and services.

The two references complement each other.

The new report on ASRS systems shows how technological advancements in warehouses can introduce physical vulnerabilities that have not yet been fully addressed by conventional security measures.

NFPA 1660, on the other hand, provides the framework within which these vulnerabilities must be assessed in terms of operational impact, alternatives, and continuity strategies.

This conclusion is relevant to any TPRM program: a supplier’s resilience does not depend solely on its IT systems, contracts, or financial statements.

It also depends on how effectively it protects the facilities and warehouses through which our business continuity physically depends.