When Does Cloud Concentration Become an Operational Resilience Risk for Investment Firms?

Cloud concentration becomes an operational resilience risk when disruption to a shared provider or service could interrupt critical workflows beyond the firm's tolerance.

For example, an investment firm's research application and investor reporting platform may have separate vendors and separate contracts. Both could depend on the same underlying cloud provider. That shared reliance creates an exposure that leadership needs to understand before deciding whether the firm's recovery arrangements are adequate.

Leaders should first identify the work each application supports and the consequences of an interruption. They should then assess shared dependencies and test whether recovery arrangements can support that work during the expected disruption. For example, a delayed research task may be manageable for a period; an interruption that prevents a time-sensitive investor report from being completed could be more problematic, even if both applications use similar technology.

What is cloud concentration risk for an investment firm?

An investment firm has cloud concentration exposure when several applications or critical workflows depend on the same cloud provider or service. That reliance becomes material when a common disruption could affect enough important work to create consequences the firm cannot comfortably absorb.

Cloud concentration is also an industry-wide concern: many financial institutions depend on the same small group of providers. For an individual investment firm, the immediate responsibility is to understand its own exposure and the conditions under which it could continue operating.

The US Treasury's February 2023 report on financial sector cloud adoption investigates both direct reliance on cloud providers and indirect reliance through third-party vendors. It explains that the effect of an incident depends on how an institution uses the service or services and how critical they are to operations. The report is a sector assessment and imposes no new requirements on financial institutions.

Provider concentration alone gives an incomplete picture of the firm's exposure. Two applications using one provider may operate in different regions and respond differently to a regional outage. They may also depend on a common service whose failure reaches across those locations.

Leadership therefore needs to connect provider information to the work the firm must perform. The relevant question is how a shared disruption would affect that work and whether the firm has a response suited to the event.

Where can shared dependencies develop?

Consider a hypothetical firm that uses one vendor for research access and another for investor reporting. Each vendor provides a dependable service under normal conditions, but both host the firm's applications with the same cloud provider.

The firm's vendor records may identify two separate providers. Technology teams should also establish whether an outage in the infrastructure supporting those providers could interrupt both applications.

Suppose the applications operate in different regions. A location-specific disruption might affect only one, leaving the other usable. However, if both depend on a common identity service, users could lose access to both applications even while their hosting environments remain available.

This directly impacts how the firm must carry out recovery efforts. Restoring an application elsewhere may offer limited value if users still cannot authenticate. The firm needs to understand which supporting services its recovery process requires.

Obtaining that information can take coordination with the application vendors. The firm should ask for enough detail to assess the continuity of its critical workflows, while recognizing that providers may restrict disclosure of sensitive infrastructure information.

Technology teams should identify shared dependencies and confirm whether vendors can recover their services if those dependencies fail. They should document any unanswered questions for the leaders approving the firm's recovery plans.

When does concentration become material?

Leaders should assess the consequences of interrupted work and the firm's ability to respond. The following questions can help them decide whether changes are needed.

How much critical work depends on the shared service?

Begin by investigating the consequences of an interruption. For example, a firm’s research team may face minimal disruption: they can defer some work or consult previously downloaded material. The reporting team may have a deadline it cannot miss without affecting client commitments.

Business owners should start by determining which workflows can be interrupted with acceptable consequences, and for how long. They can perform this assessment by reflecting on the firm's commitments and the practical effect of delayed work.

Business owners should also consider when an outage occurs. An investor reporting platform outage may cause less disruption between reporting cycles than immediately before a delivery deadline. The technology and the outage are the same, but the business impact of the outage differs based on timing.

Business owners should identify which workflows require priority recovery and how quickly they must resume. Infrastructure teams can then plan recovery around those requirements, while leadership directs resources toward the most consequential interruptions.

Could the same disruption affect several workflows?

The firm should define the outage its recovery plan must address. During a regional outage, teams may be able to restore an application in another region. If both locations require the same unavailable identity service, teams must first restore access or use an independent access method.

Firms should determine whether both vendors use one cloud provider, then establish whether a particular disruption could prevent both teams from working at the same time. That’s because simultaneous interruptions can make a response harder. Teams may compete for limited technical support during the incident, and a fallback process that depends on another affected application may be unavailable.

Technology teams should identify these shared dependencies before an incident occurs. They should also document which recovery capabilities they have tested directly and which they have assessed using vendor-supplied evidence.

Is there a workable way to continue or recover?

The reporting team must be able to finish its work within the deadline the firm has set. If the primary platform is unavailable, staff might use previously exported data to prepare the report. The team should test whether those files contain current, complete information and whether staff can use them to finish the report on time.

The Financial Stability Board's December 2023 third-party risk toolkit helps financial institutions identify the services whose disruption could impair critical operations. It asks institutions to consider the availability of backup capacity or substitutes when assessing those services. Institutions can adapt the toolkit to their circumstances and applicable regulatory requirements.

Investment firms should choose a response that keeps interruption within acceptable bounds. Leaders should require a test before relying on an unverified recovery plan.

Does adding another cloud provider reduce the exposure?

An investment firm should choose a recovery location based on the outage it needs to withstand. Another region may support recovery after a regional outage. A wider provider disruption may require an alternative that operates independently of the affected services.

Technology teams should check whether the alternative shares dependencies with the primary environment. A reporting application hosted elsewhere may still require the same unavailable identity service.

The Monetary Authority of Singapore's June 2021 Cloud Advisory identifies multicloud as a possible measure for reducing provider concentration. It also warns that multiple environments require additional resources and expertise. The advisory addresses Singapore financial institutions.

Leaders should approve a second provider only after teams explain which outage the change would address and how they would maintain and use the alternative environment.

What should recovery testing demonstrate?

Technology and business teams should test whether staff can complete critical work while the primary service is unavailable. For investor reporting, the exercise should require staff to access reliable data and finish the report within the firm's deadline.

Teams should test under the outage conditions they have defined. If the scenario includes an unavailable identity service, staff should demonstrate how they would access the recovery environment without it.

Leaders should assess emergency recovery separately from planned provider exit. A migration may allow time and provider cooperation that staff cannot count on during an outage.

For a vendor-hosted platform, the firm should test its own fallback procedure and review the provider's recovery evidence. Teams should record any obstacles or unexpected manual work so leaders can decide what to correct before approving the plan.

How should leaders decide what to change?

Leaders should document whether they accept the firm's exposure or require changes. Business owners should agree on the consequences they can tolerate, while technology teams establish what the recovery arrangements can deliver.

The firm may retain its current design when it understands the shared dependency and has demonstrated an acceptable response. It may also make a targeted change to a particular workflow whose recovery remains uncertain.

For the hypothetical firm, improving the reporting team's access to approved data could be more useful than moving every application. A different provider might be justified if the identified exposure requires independence the existing environment cannot provide.

Leaders should record the evidence supporting their decision and specify when they will review it. A new application or a material vendor change can alter the firm's reliance on the same underlying services.

Keep cloud decisions tied to critical work

Cloud concentration deserves attention because shared dependencies can interrupt several parts of a firm at once. The significance of that exposure becomes clearer when leaders can connect it to the work people must complete.

Business and technology leaders should use recovery test results to decide whether the firm can tolerate its current exposure. If teams cannot restore critical work within the required time, leaders should identify and approve the changes needed.

How Option One Technologies can help

Option One Technologies helps investment firms assess the technology supporting their critical operations. Cloud architecture and managed IT services can support clearer visibility into dependencies, while business-aligned backup and disaster recovery can strengthen continuity arrangements.

The firm's business owners should define how long critical work can be interrupted and approve any remaining risk. Option One can help connect those requirements to a supportable technical design and practical recovery testing.

Executive FAQs

Is using a single cloud provider always a concentration risk?**

Reliance on one provider creates an exposure that the firm should assess. Its significance depends on the work affected by a disruption and the recovery options available. Leadership should establish which failure scenarios the design can withstand and whether critical workflows can continue or recover within acceptable business limits.

Does multicloud protect a firm from every cloud outage?**

Protection depends on the architecture and the disruption being considered. An alternative environment may still depend on a shared supporting service, or it may require preparation before it can support work. Teams should test whether staff can use the alternative environment and complete critical work while the primary dependency is unavailable.

How is cloud exit planning different from disaster recovery?**

Cloud exit planning prepares the firm to transition away from a provider relationship. Disaster recovery prepares it to restore operations following disruption. The available time and level of provider cooperation may differ substantially. Leaders should assess the migration plan separately from the procedures staff would follow during an active outage.