Building something awesome.
Cloud concentration risk is the exposure an organisation faces when a large share of its critical operations or vendors depend on the same cloud infrastructure provider. If that provider experiences an outage or failure, multiple seemingly unrelated business functions can be disrupted simultaneously — a single point of failure that cuts across the entire enterprise.
The EU's Digital Operational Resilience Act (DORA) established direct oversight of critical ICT third-party providers. The UK's Critical Third Parties regime — under the Bank of England, PRA, and FCA — does the same for systemically important technology providers. US banking regulators including the OCC, and India's RBI, have also issued guidance addressing cloud and infrastructure concentration in third-party risk programs.
Multi-cloud strategies are increasingly common, but they do not eliminate concentration risk. Many cloud providers share overlapping data centre regions, network backbones, or sub-processors. An enterprise using three different cloud vendors may find that all three share the same underlying fibre provider or cooling infrastructure. True risk reduction requires mapping actual infrastructure dependencies, not just counting vendor contracts.
Under DORA, financial entities must identify and document their critical ICT third-party providers and demonstrate that concentration thresholds are being managed. The UK's CTP regime allows the Bank of England to conduct direct supervision of systemically important providers. Both frameworks expect boards to be aware of concentration exposure and approve risk appetite thresholds.
Crest Perspective
Risk programmes that treat third-party governance as a compliance checkbox are consistently underprepared when a material vendor incident occurs. The programmes that withstand regulatory scrutiny are those where risk tiering is documented, escalation paths are tested before they are needed, and the board receives accurate, timely information about the organisation’s most critical vendor dependencies.
Cloud concentration risk is the exposure an organisation faces when a large share of its critical operations or vendors depend on the same cloud infrastructure provider. If that provider experiences an outage or failure, multiple seemingly unrelated business functions can be disrupted at once.
The EU's Digital Operational Resilience Act (DORA) established direct oversight of critical ICT third-party providers, and the UK's Critical Third Parties regime under the Bank of England, PRA, and FCA does the same for systemically important technology providers. US banking regulators including the OCC, and India's RBI, have also issued guidance addressing cloud and infrastructure concentration in third-party risk.
There is no fixed number — the right approach depends on which functions are truly mission-critical. Rather than mandating multi-cloud everywhere, most mature risk programs focus diversification and failover investment on the small set of systems where an outage would cause material business or regulatory harm.
A critical third-party provider regime is a regulatory framework that gives supervisors direct oversight powers over technology providers, such as major cloud platforms, that are systemically important to an entire sector. It extends regulatory reach beyond the regulated firm to the infrastructure the firm depends on.
No. Multi-cloud strategies reduce but do not eliminate concentration risk, because many providers use overlapping data centre regions, network backbones, or sub-processors. True risk reduction requires mapping actual infrastructure dependencies, not just counting the number of vendor contracts.
Most organisations know they rely heavily on one or two cloud providers. Few have quantified exactly what percentage of their critical business functions depend on each provider. Building a cloud concentration risk assessment requires three steps: mapping critical functions, attributing those functions to infrastructure providers, and aggregating the results into a concentration metric the board can act on.
The mapping exercise typically reveals surprises. Organisations that believe they are multi-cloud frequently discover that their disaster recovery environments for Platform A are hosted on Platform A's own secondary regions. Similarly, organisations using different cloud providers for different workloads often find that their monitoring, logging, and identity management layers run on a single provider, creating a control-plane concentration even where workload diversification exists.
A practical framework for concentration measurement:
The practical implications of cloud concentration risk are best understood through documented incidents. The AWS us-east-1 outages in 2021 and 2022 affected thousands of dependent services simultaneously, including services that had implemented multi-region architectures within AWS but had not accounted for control-plane dependencies. Organisations that had documented their dependency on AWS's IAM and Route 53 services were better positioned to explain the incident scope to regulators than those who discovered the dependency during the outage.
The Azure Active Directory outage in 2023 affected identity services globally, disrupting organisations that had diversified their compute workloads across providers but had consolidated identity management on a single platform. This incident illustrates why concentration risk analysis must cover control-plane and supporting services, not just compute and storage.
Regulators cite these incidents as evidence that diversity of cloud providers is insufficient without diversity of control dependencies. DORA's implementing technical standards require financial entities to identify critical ICT third-party providers and assess concentration at the function level, not merely the vendor level.
Under DORA Article 29, financial entities must identify and document their use of critical ICT third-party providers and assess whether that use creates concentration risk. The European Supervisory Authorities have issued guidance on what this assessment should contain: a function-level mapping of critical dependencies, a quantified concentration metric, a comparison against the institution's defined concentration thresholds, and a remediation plan where concentration exceeds those thresholds.
DORA also requires financial entities to include concentration risk considerations in their contractual arrangements with ICT third-party providers. Contracts with providers designated as critical by the ESAs must include provisions giving the competent authority direct audit rights. Financial entities that have identified AWS, Microsoft Azure, and Google Cloud as providers of critical ICT services should already be building the DORA-compliant oversight framework those relationships will require.
The Reserve Bank of India's Master Direction on IT Governance, Risk, Controls, and Assurance Practices (2023) and its Cloud Adoption guidelines address concentration risk for Indian regulated entities. The RBI expects banks and NBFCs to conduct a risk assessment before migrating to cloud services and to maintain a vendor diversification strategy that avoids undue reliance on any single cloud provider.
The RBI's specific concern is geographic concentration: Indian regulated entities must ensure that data stored in the cloud meets data localisation requirements. Cloud concentration with a provider whose data centres are primarily outside India creates both a concentration risk and a data sovereignty compliance risk. For Indian financial institutions operating under both RBI and SEBI jurisdiction, the SEBI Cybersecurity and Cyber Resilience Framework adds additional cloud governance requirements.
Boards and senior management committees need cloud concentration information in a form that supports risk appetite decisions, not just technical architecture reviews. Effective board reporting on cloud concentration includes:
Concentration risk management is partially a procurement and contracting problem. Organisations that have contractual flexibility to shift workloads between providers when concentration thresholds are approached have meaningful risk management options that those locked into multi-year commitments do not. Key contractual provisions include data portability guarantees, interoperability requirements, and termination without penalty provisions that activate when the provider is designated as critically concentrated by a regulator.
Most cloud provider standard terms are unfavourable on these points. Negotiating portability and exit terms requires either significant volume leverage or specific regulatory pressure — which is why DORA's requirements for contracts with critical ICT third-party providers matter: they give regulated entities a regulatory mandate to negotiate provisions that commercial leverage alone might not secure.
AI-powered TPRM, compliance automation and GRC intelligence for enterprise teams.
Request a Demo →Ready to get started?
Bring structure, automation, and continuous intelligence to your GRC Process — without adding headcount.
★ Schedule a Demo