Glossary term
ICT Concentration Risk
Also: DORA Art. 29, Third-party concentration
Risk arising from dependence on a small number of or a single ICT third-party provider. DORA Art. 29 obliges financial entities to perform an explicit analysis and steering. Supervisors focus particularly on cloud hyperscalers and core banking system providers.
DORA Art. 29 requires financial entities, before contracting with an ICT third-party provider, to assess whether a concentration on a single provider or a tightly connected group of providers arises. The analysis must be documented in writing and reflected in the information register.
Dimensions: provider concentration (multiple critical functions with one provider), substitutability (realistic switch within what timeframe), sub-outsourcing chains (main and sub providers overlap), geographic concentration (multiple data centres in the same region). Practical trap: AWS Frankfurt + AWS Dublin is still AWS.
In practice
Supervisory response: in case of structural concentration risk, the national competent authority can order additional mitigation measures, demand exit plans or prohibit contracts. The Joint Examination Teams (JET) of EU supervisors for critical ICT TPPs become active 2025/2026. Concentration-risk analyses are a mandatory part of every decision memo for critical ICT contracts.
Related terms
DORA
EU regulation on digital operational resilience in the financial sector. Directly applicable since 17 January 2025. Five pillars: ICT risk management, incident management, resilience testing including TLPT, third-party governance, information sharing.
ICT Third-Party Risk
Sammelbegriff für Risiken aus dem Einsatz externer ICT-Lieferanten: Cloud-Provider, SaaS-Anbieter, MSPs, MSSPs. Unter DORA Art. 28 explizit reguliert; jeder kritische Lieferant muss in einem Register stehen und einer dokumentierten Eignungsprüfung folgen.
Critical ICT Third-Party Provider (CTPP)
ICT third-party provider designated critical by the European Commission under DORA Art. 31, falling under direct supervision of one of the three European Supervisory Authorities (EBA, EIOPA, ESMA). First CTPP designations expected in 2025/2026.
TPRM
Discipline and tool category for governing risks from external providers (SaaS, cloud, outsourcing, advisory). Mandatory under DORA Art. 28-30 for financial entities and NIS2 Art. 21 (d) for essential/important entities.
IAM (Identity and Access Management)
The stack of systems that governs who has access to which systems under which conditions. IAM covers authentication, single sign-on, lifecycle management, access governance (IGA) and privileged access management (PAM), and is the most commonly breached control in enterprise environments.
IGA
Software category for identity governance: lifecycle management, role modelling, access recertification, segregation of duties, audit trail. Pulls the governance layer out of IAM.
ISO 27001
International standard for information security management systems. Current version ISO/IEC 27001:2022. Certifiable through accredited bodies. Core framework for ISMS implementation, risk treatment, continuous improvement.
ISO 27002
Companion standard to ISO 27001 that fleshes out the 93 Annex A controls. Not certifiable, but the practical handbook for implementation.