Shared responsibility
Provider resilience does not automatically make the customer's application resilient; architecture and configuration still matter.
Identity dependency
A healthy SaaS platform is not useful if the organization cannot authenticate users.
Data and export
Continuity planning should understand backup, retention, export and recovery options for critical cloud-held information.
Provider outage
Manual workarounds, alternate communications and customer messaging may still be needed during a large provider incident.
Business continuity is organization-specific. Recovery priorities, legal duties, safety requirements, contracts, insurance terms and technical recovery methods should be validated by the responsible people in the organization.