Third-Party, Supplier & Cloud Risk
Supplier risk frameworks, concentration risk assessment, contractual resilience reviews, and cloud readiness assessments for regulated workloads — scoped to your third-party estate and tailored to your regulatory obligations under DORA and beyond.
What to expect — Module A: Supplier/Third-Party Risk Framework
Review of your existing third-party risk policy and register of ICT providers
Stakeholder interviews with procurement, vendor management and risk
Criticality tiering methodology designed and assessed against DORA third-party risk requirements
Sample contract review against required contractual provisions, with framework and recommendations report
Module B: Cloud Concentration & Exit-Risk Assessment
Cloud service inventory and dependency mapping
Concentration risk analysis — hyperscaler dependency and single points of failure
Exit strategy and substitutability assessment
Cloud risk report, recommendations and executive readout
Typical duration: 5–6 weeks for both modules (3 weeks standalone)
What DORA requires
DORA's ICT third-party risk management provisions (Chapter V, Articles 28–44) are among the most prescriptive in the regulation. They require in-scope financial entities to:
Maintain a register of information on all contractual arrangements with ICT third-party providers, identifying which ones support critical or important functions.
Assess concentration risk before contracting with a new critical ICT provider, and monitor it on an ongoing basis.
Include specific contractual provisions with every critical ICT provider — audit and access rights, exit assistance, sub-outsourcing notification, and clear service-level descriptions, among others required under Articles 28–30.
Maintain an exit strategy for each critical ICT provider, so the firm isn't unable to leave if the relationship needs to end.
Cloud services are a specific focus area, since concentration in a small number of hyperscalers is exactly the kind of systemic dependency DORA's third-party provisions were written to surface.
Is this for you?
This is for any DORA-scope entity — banks, insurers, payment and e-money firms, investment and asset managers — that:
Doesn't have a clean, current register of ICT third-party providers, or isn't confident which ones would count as critical.
Has never formally assessed concentration risk across its cloud and critical-supplier estate.
Is renewing or renegotiating contracts with critical ICT providers and needs to know what DORA requires be in them before signing.
Needs a standalone cloud concentration and exit-risk view, separate from the broader supplier register work.
It's also relevant to UK-only firms without direct DORA exposure who want the same discipline applied under the UK's own operational resilience and outsourcing expectations — the assessment method transfers directly.
Frequently asked questions
Can we buy just the cloud piece, or just the supplier framework?
Yes — the two modules (supplier/third-party risk framework, and cloud concentration/exit-risk assessment) are sold independently or bundled. Module B (cloud) alone suits a firm that already has a supplier risk framework but hasn't specifically assessed cloud concentration.
How long does each module take?
Around 3 weeks elapsed per standalone module (10 days for the supplier framework, 8 days for the cloud assessment), or 5–6 weeks bundled.
We don't have an existing register of ICT third-party providers. Can you still help?
The engagement as scoped assumes a register exists to assess and improve. Building one from scratch is additional effort beyond the standard scope — flagged and agreed upfront on the kickoff call, not assumed.
What do you actually check in our contracts?
Contracts with critical providers are checked against the specific provisions DORA requires under Articles 28–30 — audit rights, exit assistance, sub-outsourcing notification, and service-level clarity. This is a gap review against those requirements, not a full legal contract redraft.
Does this replace legal advice?
No — the framework identifies what's contractually required and where the gaps are; drafting or renegotiating the actual contract language is a follow-on with your legal counsel.
What does it cost?
Scoped and quoted after a short call — there's no published price. Module A (supplier framework) and Module B (cloud concentration and exit-risk) are priced separately, with a discount when bundled. Get in touch and we'll confirm scope and cost together.
Supplier risk frameworks, concentration risk assessment, contractual resilience reviews, and cloud readiness assessments for regulated workloads — scoped to your third-party estate and tailored to your regulatory obligations under DORA and beyond.
What to expect — Module A: Supplier/Third-Party Risk Framework
Review of your existing third-party risk policy and register of ICT providers
Stakeholder interviews with procurement, vendor management and risk
Criticality tiering methodology designed and assessed against DORA third-party risk requirements
Sample contract review against required contractual provisions, with framework and recommendations report
Module B: Cloud Concentration & Exit-Risk Assessment
Cloud service inventory and dependency mapping
Concentration risk analysis — hyperscaler dependency and single points of failure
Exit strategy and substitutability assessment
Cloud risk report, recommendations and executive readout
Typical duration: 5–6 weeks for both modules (3 weeks standalone)
What DORA requires
DORA's ICT third-party risk management provisions (Chapter V, Articles 28–44) are among the most prescriptive in the regulation. They require in-scope financial entities to:
Maintain a register of information on all contractual arrangements with ICT third-party providers, identifying which ones support critical or important functions.
Assess concentration risk before contracting with a new critical ICT provider, and monitor it on an ongoing basis.
Include specific contractual provisions with every critical ICT provider — audit and access rights, exit assistance, sub-outsourcing notification, and clear service-level descriptions, among others required under Articles 28–30.
Maintain an exit strategy for each critical ICT provider, so the firm isn't unable to leave if the relationship needs to end.
Cloud services are a specific focus area, since concentration in a small number of hyperscalers is exactly the kind of systemic dependency DORA's third-party provisions were written to surface.
Is this for you?
This is for any DORA-scope entity — banks, insurers, payment and e-money firms, investment and asset managers — that:
Doesn't have a clean, current register of ICT third-party providers, or isn't confident which ones would count as critical.
Has never formally assessed concentration risk across its cloud and critical-supplier estate.
Is renewing or renegotiating contracts with critical ICT providers and needs to know what DORA requires be in them before signing.
Needs a standalone cloud concentration and exit-risk view, separate from the broader supplier register work.
It's also relevant to UK-only firms without direct DORA exposure who want the same discipline applied under the UK's own operational resilience and outsourcing expectations — the assessment method transfers directly.
Frequently asked questions
Can we buy just the cloud piece, or just the supplier framework?
Yes — the two modules (supplier/third-party risk framework, and cloud concentration/exit-risk assessment) are sold independently or bundled. Module B (cloud) alone suits a firm that already has a supplier risk framework but hasn't specifically assessed cloud concentration.
How long does each module take?
Around 3 weeks elapsed per standalone module (10 days for the supplier framework, 8 days for the cloud assessment), or 5–6 weeks bundled.
We don't have an existing register of ICT third-party providers. Can you still help?
The engagement as scoped assumes a register exists to assess and improve. Building one from scratch is additional effort beyond the standard scope — flagged and agreed upfront on the kickoff call, not assumed.
What do you actually check in our contracts?
Contracts with critical providers are checked against the specific provisions DORA requires under Articles 28–30 — audit rights, exit assistance, sub-outsourcing notification, and service-level clarity. This is a gap review against those requirements, not a full legal contract redraft.
Does this replace legal advice?
No — the framework identifies what's contractually required and where the gaps are; drafting or renegotiating the actual contract language is a follow-on with your legal counsel.
What does it cost?
Scoped and quoted after a short call — there's no published price. Module A (supplier framework) and Module B (cloud concentration and exit-risk) are priced separately, with a discount when bundled. Get in touch and we'll confirm scope and cost together.