CeFPro Connect

Article
Cloud Concentration Risk Is Exposing Dangerous Gaps in Third Party Resilience
Mark Carroll, Founder – Graduate ERM Program at Boston University, warns that hidden cloud dependencies and inadequate supplier testing are exposing weaknesses in third-party resilience. He explains why financial institutions must strengthen dependency mapping, demand evidence of recovery capabilities and prepare for cloud outages rather than assuming infrastructure diversification guarantees operational continuity.
Oct 28, 2026
Mark Caroll
Mark Caroll, Founder of the Graduate ERM Program , Boston University
Tags: Vendor and Third Party Risk
Cloud Concentration Risk Is Exposing Dangerous Gaps in Third Party Resilience
The views and opinions expressed in this content are those of the thought leader as an individual and are not attributed to CeFPro or any other organization



  • Hidden fourth-party dependencies create significant cloud concentration risks
  • Supplier assessments must identify underlying single-source dependencies
  • Certifications alone cannot demonstrate genuine operational resilience
  • Recovery testing and incident evidence provide stronger supplier assurance
  • Reliable operational data can help institutions function during cloud outages
  • Cloud-hosted AI must fall within existing third-party risk frameworks
  • Multi-cloud strategies may introduce complexity without eliminating concentration
  • Effective resilience requires contingency planning and dependency visibility
Log in to continue or register for free
WHAT'S INCLUDED:
Unlimited access to peer-contribution articles and insights
Global research and market intelligence reports
Discover Connect Magazine, a monthly publication
Panel discussion and presentation recordings
Sign in to view comments
ad
Related insights —