You did the work. You identified your critical business functions. You assigned RTOs and RPOs. You got sign-off from the business. You filed the document somewhere a auditor can find it.

Most people believe they are doing business with one company. In reality, they just entered a complex and largely invisible supply chain of vendors they will never see.