If many of our critical services depend on one provider, then what do we do about it?

Start

Several critical services depend on one provider

Tiering looks at one supplier at a time. Concentration looks across them: a provider that several critical services depend on can stop them all at once. Typical cases are a managed IT provider, a cloud host or a network provider. A financial entity under DORA must also assess this concentration risk.

• Then: List critical services and the suppliers behind each

Step

List critical services and the suppliers behind each

Take the critical services your continuity plan or business impact analysis names, with their owners. Against each supplier in your register, list the critical services it supports. The pack suggests keeping this as a column in the register, not a separate spreadsheet.

• Then: Mark each provider that two or more critical services use

Step

Mark each provider that two or more critical services use

Two or more critical services makes a provider a concentration provider. In the pack's example, 6 of 14 Tier 1 suppliers qualify, and one managed IT provider supports three critical services. Reading the list the other way, service by service, shows which services depend on the most suppliers.

• Then: Look for hidden concentration beneath your suppliers

Step

Look for hidden concentration beneath your suppliers

Several suppliers may all run on the same cloud platform or the same software. Ask each Tier 1 supplier for its own critical providers at assessment. Where your IT is run by a service provider, the providers it relies on for your service belong in the register too, where you can name them.

• Then: Is the provider assessed at Tier 1, and in date?

Decision

Is the provider assessed at Tier 1, and in date?

A supplier that runs or supports a critical service is Tier 1. The pack's default is reassessment at least every 12 months, with continuous monitoring for breach news, certificate expiry and material changes. If you cannot find the last assessment, answer not known.

• Yes: Is there a current exit plan for it?
• No, or not known: Tier and assess it now, most critical first

Step

Tier and assess it now, most critical first

The pack takes suppliers never tiered or assessed in order of likely criticality. Among concentration providers, starting with the one most critical services depend on is a reasonable reading of that; the order is your call. An overdue Tier 1 reassessment is named in the quarterly report. The assessment ends in a signed decision by the business owner.

• Then: Is there a current exit plan for it?

Decision

Is there a current exit plan for it?

The pack's target for concentration is that each provider is known and has an exit plan. An exit plan covers data return or deletion, access removal and a transition period. The pack's exit clause has the plan reviewed each year by default; if yours has not been reviewed in that time, treat it as not current.

• Yes: Could you replace it before the services can bear no more?
• No, or not known: Write the exit plan with the provider

Step

Write the exit plan with the provider

Agree data return, removal of access, the knowledge to hand over and a transition timetable. The pack's exit clause asks the supplier to keep providing the service for a transition period at your request, so leaving does not stop a critical service. If the contract lacks that clause, the pack's worked example adds it at the next variation or renewal, or records the gap as an exception.

• Then: Could you replace it before the services can bear no more?

Decision

Could you replace it before the services can bear no more?

This is the substitutability answer from tiering, checked again. The pack's default threshold is 3 months, which you set to the longest outage your critical services can bear. Confirming this answer for each concentration provider is one of the pack's standing checks. If nobody has tested the answer, answer not known.

• Yes: Do its recovery targets fit every service it supports?
• No, or not known: Enter the dependency as a risk in your risk register

Decision

Do its recovery targets fit every service it supports?

Compare the recovery time and data loss in the provider's contract with what each dependent service needs. The most demanding service sets the bar. A supplier recovering in 72 hours cannot support a service you need back in 24. If the contract sets no recovery targets, answer no.

• Yes: Report the concentration list every quarter
• No, or not known: Enter the dependency as a risk in your risk register

Step

Enter the dependency as a risk in your risk register

Write it as a scenario, such as 'managed IT provider fails or is compromised', in your third-party dependency category. Rate impact on the worst credible consequence: several critical services stopping at once. In the pack's example this is one named risk with one owner.

• Then: Is the risk outside your appetite?

Decision

Is the risk outside your appetite?

Compare the residual band with the appetite for third-party dependency. In the pack's example, that appetite is Cautious: a High residual risk is outside appetite, a Critical one outside tolerance. If it has not been scored, answer not known.

• Yes, or not known: The risk owner decides the treatment
• No: Report the concentration list every quarter

Outcome

The risk owner decides the treatment

The pack's default is a decision within 30 calendar days. The pack manages concentration through exit planning and continuity arrangements, so reducing can mean stronger recovery terms or a tested exit. Avoid means moving the service. Accept needs the band's approvers, plus executive management when outside appetite. Past tolerance, only the board may accept, or a board risk committee it delegates to; the management board in a two-tier structure; executive management where there is no board.

Outcome

Report the concentration list every quarter

Report each concentration provider to executive management every quarter, with whether it has an exit plan. Recount when a service becomes critical, a supplier takes on a new service, or your regulatory status changes. Your dependence is then known and planned for, which is the pack's target.