Concentration Risk and Critical Third Parties
Why DORA treats concentration risk as a firm-wide and sector-wide question, and how the oversight framework for critical ICT providers fits into that picture.
Line 11: Concentration risk and critical third parties
When many services lean on one provider, one region, or one technology: measuring concentration and the oversight framework for critical providers.
The line guide
Working guides on this line
Critical ICT Third-Party Oversight Framework
How DORA organises oversight of critical ICT third-party providers at EU level, and how that framework relates to a firm's own third-party duties and oversight expectations.
Geographic Concentration
How reliance on one region can link otherwise separate services, and what a geographic view adds to a provider-by-provider risk picture across important services.
Joint Examination Teams Explained
How joint examination teams carry out oversight work on critical ICT providers, and what their findings mean for financial entities using those providers.
Lead Overseer Role Explained
What the Lead Overseer does within DORA oversight of critical ICT providers, and how that role differs from supervising a financial entity for a designated provider.
Measuring Concentration Risk
How a financial entity can build a picture of concentration that counts shared dependencies, not just supplier names, across its important services and recovery planning.
Reducing Concentration Without Breaking Services
Practical ways to lower concentration risk, from splitting services to strengthening exit plans, without introducing disruption that outweighs the benefit.
Single-Provider Concentration
What happens when many important services depend on one provider or one provider group, and why that risk differs from ordinary supplier dependence in practice for firms.
Technology Concentration
When important services share one platform, component, or connection method, a single technical fault can spread further than any one supplier failure.