Concentration risk, when the register hides a single point of failure

A register scores vendors one at a time. Concentration is a property of the set, so a portfolio in which every vendor is individually acceptable can still be one cloud region away from a bad afternoon. The exposure is invisible at the row level and obvious at the portfolio level, and most tooling only looks at rows.

It appears in three shapes. Vendor concentration — one supplier running several critical processes. Geographic concentration — multiple vendors in one region, jurisdiction or data centre. And fourth-party concentration, the one that actually bites: eleven vendors that look unrelated on the register and resolve to the same hosting provider, payment processor or identity platform underneath. That one is only visible if you map fourth-party relationships.

For EU financial entities, DORA makes this explicit: firms must assess whether an ICT contract would lead to concentration before signing it, and the register of information exists partly so supervisors can see concentration across the sector that no single firm can see from inside its own register. The UK's critical third parties regime is built on the same observation — that systemic exposure sits with providers several firms share.

Practically, the reporting that matters is a portfolio view: critical processes by vendor, vendors by region, and vendors by shared fourth party. If you can only produce the first of the three, concentration is being managed on the basis of the exposure you can see.