GCRI · Cybersecurity and Digital Resilience
Cloud and third parties
Organisations increasingly rely on cloud platforms, managed service providers and software vendors to run critical functions. This moves operations outside their direct control and concentrates many organisations on a few providers, so one outage or breach can affect thousands. This page sets out how third-party and cloud dependence creates risk, how it is mapped and managed, and what evidence serves the organisations and regulators involved.
How the work runs.
Security posture and third parties
Cloud and third parties · Enterprise network · Quarter 2
CSF profile, current vs target
tier 1 to 4
Critical suppliers
| Supplier A | Cloud hosting | Yes | Medium |
| Supplier B | Payroll SaaS | No | Unknown |
| Supplier C | Managed SOC | Yes | Low |
| Supplier D | Identity provider | No | Unknown |
Critical vulnerabilities open
Fig.Security posture and third parties: example names and illustrative values, not a record or a live system.
Cloud and third parties: how the risk develops.
Concentration and vendor dependency. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Shared responsibility is easy to misread
Cloud providers secure their infrastructure; customers secure their configuration, data and identities. Many incidents come from customer misconfiguration.
Concentration creates systemic exposure
A few providers host a large share of services. An outage in one region or a faulty update can disrupt many sectors at once.
Managed providers hold the keys
Managed service providers have privileged access to many clients. Compromising one provider can reach all of them.
Contracts set what is possible
Audit rights, incident notification, exit and data location depend on contracts. Weak terms leave customers unable to see or act on provider risk.
Connected activity in Europe.
Night lights, population density and true-colour imagery over Europe, from NASA GIBS. Each layer carries its own date.
The interactive map needs JavaScript; the layer list and sources are below.
Layers 3
Connected activity, for this page
Keyboard, with the map focused
Hold Ctrl or ⌘ and scroll to zoom
Latest available
NASA GIBS / EOSDIS · ASTER GDEM (METI, NASA) · Blue Marble (NASA) · © OpenStreetMap contributors (ODbL) · Natural Earth
Loading the latest NASA imagery.
Drag to move. Ctrl or ⌘ and scroll, pinch or the buttons to zoom; hover for the values under the pointer; reset returns to the region.
Connected activity, framed on Europe.Satellite and model products as NASA publishes them, each with its own date. They are indicators, not assessments of any place.
Data: NASA GIBS · ASTER GDEM · Blue Marble · © OpenStreetMap contributors · Natural Earth · NASA EONET · NASA HLS S30Sources and licences
- We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS). Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA open data
- We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS). Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA open data
- VIIRS Black Marble night-time lights, NASA Goddard Space Flight Center; distributed by the NASA Level-1 and Atmosphere Archive and Distribution System (LAADS DAAC); imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA open data
- Center for International Earth Science Information Network (CIESIN), Columbia University. 2018. Gridded Population of the World, Version 4 (GPWv4): Population Density, Revision 11. NASA Socioeconomic Data and Applications Center (SEDAC). Licensed under CC BY 4.0. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). doi:10.7927/H49C6VHW. CC BY 4.0
- VIIRS near-real-time products (flood, land surface temperature, snow cover, corrected reflectance), NASA LANCE; imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA open data
- MODIS land products (vegetation indices, gross primary production, land cover), NASA LP DAAC and LANCE; imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA open data
- ASTER GDEM is a product of METI and NASA (ASTER Global Digital Elevation Model V003, NASA LP DAAC); imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). Cite as: NASA/METI/AIST/Japan Spacesystems and U.S./Japan ASTER Science Team (2019). ASTER Global Digital Elevation Model V003. doi:10.5067/ASTER/ASTGTM.003. NASA open data
- Made with Natural Earth. Free vector and raster map data @ naturalearthdata.com. Public domain
- © OpenStreetMap contributors (ODbL), via NASA GIBS (coastlines, boundaries, roads and place names). Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). ODbL
- Blue Marble, NASA Earth Observatory; imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA open data
- Context on the globe and flat map: coastlines, boundaries, roads and place names from NASA GIBS reference layers (OpenStreetMap data, ODbL, © OpenStreetMap contributors); Blue Marble imagery as an optional base; 3D terrain and the elevation read-out from the ASTER GDEM elevation colour index (5 m to 200 m classes, exaggerated for legibility). Boundaries are drawn as published and imply no position on any territory.
- Live events: NASA Earth Observatory Natural Event Tracker (EONET); events are indicative and keep their original source links.
- Observed (EO): NASA HLS S30 (contains modified Copernicus Sentinel data 2026). We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS).
- NASA GIBS: We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS).
- Optional layers (5 sources in the layer list: live, forecast, observed and context) print their provider credit on the map and here when switched on; forecasts are model output and derived indices are estimates.
Layers and dates
- Night-time lights, daily: VIIRS Black Marble (VNP46A2), NASA LAADS DAAC · 12 Oct 2026
- Population density, 2020: Population: CIESIN, Columbia University, Gridded Population of the World v4.11 (2018), NASA SEDAC, CC BY 4.0 · static
- Flood water, 3-day composite: VIIRS Global Flood Product, NASA LANCE · 14 Oct 2026
- True colour: VIIRS NOAA-20 corrected reflectance, NASA LANCE · 13 Oct 2026
- Land cover type (IGBP), yearly: MODIS Terra and Aqua land cover (MCD12Q1), NASA LP DAAC · 2024
- Enhanced vegetation index, rolling 8 days: MODIS Terra EVI, NASA LANCE · 13 Oct 2026
Cloud concentration is a common mode across domains.
- HealthCouplingHealth records and imaging move to shared platforms.What to watchSingle-region dependence
- FoodCouplingLogistics and payments run on shared services.What to watchThird-party concentration
- EnergyCouplingMarket and metering systems use third-party services.What to watchExit and substitution plans
Concentration studies are designed for the Strategic Systems series. The EU's Digital Operational Resilience Act, applying from January 2025, created oversight of critical third-party providers to finance; the Global Centre for Risk and Innovation (GCRI) rates no provider.
- Third-party dependency maps under terms.
- Exit plan exercises.
Model cloud and third parties as a system. Run the cascade.
Assembled from the Nexus Standards area profile Cyber and digital resilience law alignment: the hazards it names, the systems and sectors that carry the loss, the controls that dampen it and the data that observe it. Choose the components, pick an initiating hazard and step through the cascade. The Map view places the run on an example geography with open data. Every coupling weight is a stated assumption you can change. A teaching model, not a forecast, an assessment or a certification. To model a place of your own choosing, open the full System Builder.
Hazards
- Dam failure
- Sea-ice loss
- Coastal erosion (set off downstream)
- River flood (set off downstream)
- Flash flood (set off downstream)
- Mass displacement (set off downstream)
- Biodiversity loss (set off downstream)
- Widespread power outage (set off downstream)
- Water supply shortfall (set off downstream)
- Arctic winter sea-ice collapse (set off downstream)
- Polar vortex disruption (set off downstream)
Systems and couplings
Controls
NS-10Policies and clauses (machine-readable obligations: definition, binding, evaluation and enforcement)NS-11Verification and monitoring (evidence, attestations, zero-trust conformance observation)NS-9Contextual UNIs (deployments, instances, programme instances)NRS-X6Cyber and digital security riskNRS-H93Hazard family: Identity, trust and cryptographic failure (NHS-1 cyber.identity)NRS-K31Domain pack profile: Cyber national resilience (DOMAIN-031)NRS-H54Hazard family: Signal and platform disruption (NHS-1 cyber.platform)NRS-H86Hazard family: Telecom and data-centre failure (NHS-1 infra.digital)NRS-H94Hazard family: Systemic cyber events (NHS-1 cyber.systemic-cyber)
Observation
- NIST National Vulnerability Database APIs (listed for reference)
- CISA Known Exploited Vulnerabilities catalogue (listed for reference)
- EUR-Lex Cellar (EU legal acts and delegated acts) (listed for reference)
- Cybersecurity Supply Chain Risk Management
- Legal measures pillar of the Global Cybersecurity Index
Example geography
- North America: 243 hexagonal cells
- Night lights tonight, outages (VIIRS Day/Night Band), NASA GIBS
- Surface water through cloud, 30 m (OPERA DSWx-S1 radar), NASA GIBS
- Rain rate, last half hour (IMERG), NASA GIBS
- Vegetation disturbance alerts, 30 m (OPERA DIST-ALERT), NASA GIBS
What is measured, and how well.
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Critical services hosted with a single provider | count | per inventory | Third-party registers | DECLARED |
| Third parties with privileged access | count | quarterly | Access management records | OBSERVED |
| Cloud misconfiguration findings | count by severity | weekly | Cloud security posture tools | OBSERVED |
| Contracts with incident notification and exit terms | percent of critical contracts | annual | Contract reviews | REPORTED |
| Provider outages affecting services | count and hours | annual | Provider status history and incident logs | OBSERVED |
| Market share of top cloud providers | percent of market | annual | Market studies | ESTIMATED |
How cloud and third parties is modelled, measured and tested.
The model, its assumptions, its data and its uncertainty, in the form a scientist or engineer would check. Structures follow published methods. The values drawn are illustrative, not findings.
System model
The couplings between the systems in cloud and third parties: signs of influence, a reinforcing and a balancing loop, and cross-links where stress jumps.
Where the evidence comes from.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| DORA register of information and ICT third-party oversight materials | Requirements and oversight of critical ICT providers in EU finance | Public, EU terms |
| Provider public incident and status histories | Records of cloud outages | Public, terms per provider |
| Competition authority cloud market studies | Market structure and concentration | Public records, licence per authority |
| Joint agency guidance on managed service provider security | Practices for customers and providers | Public, terms per agency |
| Financial Stability Board work on third-party risk | Toolkit for third-party risk management and oversight | Public, FSB terms |
Who decides, and what the evidence serves.
Cybersecurity and Digital Resilience prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Organisations using cloud and managed services | Which functions to keep multi-provider or on-premises and what terms to require | Dependency maps; contract reviews |
| Financial and sector regulators | Whether to designate and oversee critical third-party providers | Concentration analyses; outage history |
| Procurement authorities | What security terms to require from vendors | Contract term evidence |
Outputs this topic produces
- Third-party dependency maps for critical functions
- Concentration analyses across a sector
- Contract term reviews for cloud and managed services
- Exit and substitution scenario designs
What experts ask.
Outsourcing a function does not outsource responsibility for it. When a provider fails, its customers still answer to patients, citizens and customers. And when many organisations rely on the same provider, a single outage or compromise becomes a systemic event. Understanding where these concentrations lie is a precondition for resilience at the level of a sector or a country.
- Which providers, platforms and services does an organisation or sector depend on, including through its suppliers' suppliers?
- How concentrated are those dependencies, and what would happen if a major provider failed for hours or days?
- What contractual, technical and operational measures allow continuity or exit if a provider fails?
- Who has visibility of sector-wide concentration, and who is responsible for managing it?
Drivers and processes.
Third-party risk combines technical, contractual and systemic elements.
Shared providers
A few cloud, identity, content delivery and managed security providers underpin many services. Their failure modes are shared by all their customers.
Hidden dependencies
Organisations often know their direct suppliers but not the providers those suppliers use, so concentration can be invisible until an outage reveals it.
Substitutability
Moving workloads between providers can take months. Lock-in through proprietary services limits the options available in a crisis.
Concentration has benefits as well as costs. Large providers invest heavily in security and reliability, and many smaller organisations are safer in a well-run cloud than on their own servers. The policy question is not whether to use shared providers but how to make their failure survivable: through visibility of dependencies, tested fallbacks and arrangements for coordinated response when a widely used service goes down.
How the evidence is built, and its limits.
- 01
Supplier inventories
Registers of critical third parties and the services they support. They are often incomplete beyond the first tier.
- 02
Outage analysis
Public post-incident reports from providers describe causes and timelines. Their detail and candour vary.
- 03
Network analysis
Dependency graphs built with network science and contagion reveal concentration and single points of failure, within the limits of available data.
- 04
Scenario exercises
Exercises that simulate a major provider outage test continuity plans and expose assumptions.
How it is studied, and what the methods cannot say.
- 01Network science and contagionAttack path analysis · Digital dependency concentration · Coordination detectionApplied here
- 02Cybersecurity and cryptographyControl baselines and gap analysis · Exploited vulnerability prioritisationApplied here
- 03Reliability and resilience engineeringRecovery architecture · Degraded operation modes · Recovery time testingApplied here
- 04Communications and network technologyNetwork segmentation design · Protocol security review · Post-quantum protocol readinessApplied here
Where this page's references lead.
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
Where this page leads across the Consortium.
Questions and answers.
What is the shared responsibility model?
Why is cloud concentration a systemic risk?
What is fourth-party risk?
Is cloud less secure than on-premises systems?
Does the platform rate cloud providers?
Can an organisation use several clouds to reduce risk?
Contribute evidence from this page.
Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
- EmailGateway GW-GCRISend it from this pageEvidence, a correction, a case, a method, a review, a translation or profile input. It arrives tagged with this page, so the editor who owns it receives it.
- ZenodoOpen depositDeposit it and submit to the communityPublish your own record on Zenodo with your ORCID iD, then submit it to the Reports community there. Curators review it; the DOI stays yours.
- ReportsGCRISee every way to contributeThe contribution types, how each is reviewed, what credit you receive, the licence and what is never accepted.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
Bring a method, a dataset or a question.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.