Financial Cyber and Operational Resilience
The Global Risks Alliance (GRA)
Financial firms run core services on cloud platforms and outsource operations to specialist providers. Outsourcing can improve resilience and security, and it also creates dependence on providers the firm does not control. This page sets out how cloud and outsourcing risks arise, how they are governed and measured, and who decides.
GRA · In development · service level R0
Cloud and outsourcing risk is the risk financial firms take on when they run services on cloud platforms or rely on outsourced providers they do not control. It covers misread responsibilities, sector concentration, oversight rights and exit. Boards, supervisors, vendor managers and providers hold the decisions.
How a failure at one financial centre can spread through settlement links. Design links, not real dependencies.
The working screen behind this subject: its structure, terms and states. Names are placeholders and values illustrative.
Cloud and outsourcing · Bank B services · Self-assessment 3
| Make a payment | 3 | 1 | Cloud region loss | Outside |
| Access cash | 23 | 7 | Cyber attack | Within |
| Mortgage servicing | 49 | 39 | Data centre loss | Within |
| Claims payment | 26 | 70 | Third-party failure | Outside |
people · process · technology · third parties
Concentration and resilience. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Cloud providers secure the platform; customers secure their configuration and data. Misunderstanding the split leaves gaps such as exposed storage.
Many firms use the same few providers. An outage at one affects many firms at the same time.
Firms need audit, access and information rights in contracts. Without them, they cannot assess the provider or show supervisors they can.
Moving a core service away from a provider can take years. Exit plans must be realistic and tested to be credible.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Shared responsibility model | The split of security duties between a cloud provider and its customer. |
| Material outsourcing | An outsourcing arrangement important enough to a firm's critical services to need extra governance. |
| Audit rights | Contract rights allowing a firm and its supervisor to inspect a provider's controls. |
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Material outsourcing arrangements | count | annual | Outsourcing registers | DECLARED |
| Critical services hosted on public cloud | share of critical services | annual | Firm and supervisory surveys | REPORTED |
| Contracts with full audit and access rights | share of material arrangements | periodic | Contract reviews | DECLARED |
| Cloud misconfiguration incidents | count | annual | Incident records | REPORTED |
| Exit plans tested | share of material arrangements | periodic | Firm records | DECLARED |
| Provider outages affecting financial firms | count and duration | annual | Incident reports | OFFICIAL |
The topic as a computational graph: named sources feed the methods, an evidence review gates the outputs, and the decisions stay with the authorities that hold them.
Fig. 02Nodes carry their type, two metric rows and a state; connectors show what feeds what; dashed frames name the owners; the timeline is the cadence. Design of the pipeline, not a record of a run.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| EBA guidelines on outsourcing arrangements | EU expectations for bank outsourcing | Free, EU reuse terms |
| PRA supervisory statement on outsourcing and third-party risk management | UK expectations | Free, Bank of England terms |
| FSB toolkit for third-party risk management and oversight | Common tools and terms | Free, FSB terms |
| DORA register of information requirements | EU register of ICT third-party arrangements | Free, EU reuse terms |
| Provider post-incident reports | Root causes of cloud outages | Free to read, terms per provider |
Financial Cyber and Operational Resilience prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Boards and senior management | Which services to outsource and to whom | Risk assessments, contract terms and concentration evidence |
| Supervisors | Whether outsourcing governance is adequate | Registers and contract reviews |
| Procurement and vendor management | Which contract terms to require | Regulatory requirements and practice |
| Cloud and service providers | How to support customers' regulatory obligations | Regulatory expectations |
Concentration is the paradox at the heart of this topic. Each firm moving to a well-run provider may become more resilient, while the sector as a whole becomes more dependent on that provider.
Large providers can invest in security and redundancy beyond what most firms can afford alone.
An outage or compromise at a major provider can affect many firms at once.
Proprietary services and data volumes make switching slow and costly.
Aggregating which services rely on which providers, using network science. Limits: firm-level data is sensitive and incomplete.
Studying feasibility of exit and substitution. Limits: plans are rarely tested at scale.
Comparing contractual terms for audit, information and recovery. Limits: contracts are confidential.
Exploring provider failure scenarios, using resilience engineering. Limits: illustrative.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.