A compound risk that business continuity and performance may be affected by a major earthquake, cyberattack, or damage to the supply chain, including suppliers and customers. Covers responses to both physical disasters and cyber incidents, including crisis management systems, disaster-prevention facilities and training, CSIRT activities, and incident response exercises.