Making fourth parties and concentration risks visible

Subcontractors create new nodes in the risk chain

Transparency should focus on the parts of the supply chain that affect the specific service, relevant data or recovery objectives. A bare list of all subcontractors without role and region helps little.

Concentration is a portfolio risk

The critical dependency often only becomes visible when relationships are viewed together. Several SaaS providers may use the same hyperscaler, DNS service or identity provider.

• record critical fourth parties per service
• aggregate shared platforms and regions
• test outage and exit scenarios across the portfolio
• have top management accept deliberate risk concentration