Lesson 4.38: ICT concentration risk and exit plans
Outsourcing moves operations to a provider, not the responsibility. When one cloud provider hosts most of what matters, its outage, price change or failure becomes the company's crisis, and leaving it is hard. DORA requires financial entities to keep a register of information on all ICT third-party arrangements, assess concentration risk and have exit strategies for providers supporting critical functions; it's good practice for everyone. In the lab you read Northwind's register, count arrangements per provider, find which services one provider sits behind, and check exit plans and alternatives for the critical ones.
19 min
You will learn to
- Read a register of ICT third-party arrangements
- Measure concentration per provider
- Find services that depend on one provider
- Check exit plans for completeness and testing
- Weigh substitutability
Key terms
- Register of information
- DORA's mandatory list of all contractual arrangements on ICT services with third-party providers.
- Concentration risk
- Dependence on one provider (or a few) for many critical functions.
- Exit strategy
- A documented, tested way to move a service to another provider or in-house.
- Substitutability
- How easily a provider can be replaced within a reasonable time and cost.
- Critical function
- A function whose disruption would materially impair the entity's operations or obligations.
← Managing a penetration test · All lessons · Post-quantum migration as a multi-year programme →