Concentration risk: when everyone depends on the same three providers

Most outsourcing registers list dozens of suppliers, which suggests a diversified estate. Trace the dependencies one layer deeper and the picture narrows sharply: a handful of cloud regions, one identity provider, one payments rail, and a shared set of sub-processors sitting beneath nominally distinct vendors.

Regulators are increasingly interested in that second layer. The relevant question is not how many vendors you use but how many single points of failure you would discover during an outage. Answering it requires mapping critical or important functions to the technical components that deliver them — then asking which of those components has no substitutable alternative within your recovery time objective.

Where substitution is impossible, the honest response is a documented, board-accepted concentration risk with compensating monitoring, not an exit plan that could never be executed.