How many critical suppliers depend on the same thing?

How many critical suppliers depend on the same thing?

Vendor count is not diversification. Two suppliers may depend on the same cloud region, software library, subcontractor, manufacturing plant, port, energy network or specialist workforce. Contractual separation can therefore conceal a single operational exposure.

Map the service, not just the legal entity. For every critical outcome, trace prime suppliers, material subcontractors, hosting locations, control planes, data routes, logistics nodes and ultimate ownership. Record which dependencies are substitutable, the time and data needed to switch, and whether capacity would still be available during an industry-wide event.

European financial regulation offers a useful operating signal. DORA became applicable in January 2025 and requires in-scope firms to maintain registers of ICT third-party arrangements; its EU oversight framework explicitly addresses systemic and concentration risk arising from reliance on a limited number of critical providers. The mapping principle extends well beyond finance.

Test correlated scenarios: one cloud identity failure, common cyber compromise, regional power loss, export restriction, transport closure or upstream insolvency. Ask suppliers for evidence rather than assurance, include audit and notification rights, and monitor changes in subcontracting. A nominal exit clause has little value if migration takes longer than the business can tolerate.

Prioritise exposures by consequence, substitutability and switching time. Reduce them through architectural portability, inventory, dual tooling, alternate routes or explicit acceptance backed by larger buffers. The objective is not eliminating concentration; it is seeing where independent-looking choices collapse onto the same point of failure.