GRA · Financial Cyber and Operational Resilience
Spatial financeWhere capital meets hazard, exposure and transition
Cloud and outsourcing
Financial firms run core services on cloud platforms and outsource operations to specialist providers. Outsourcing can improve resilience and security, and it also creates dependence on providers the firm does not control. This page sets out how cloud and outsourcing risks arise, how they are governed and measured, and who decides.
Cloud and outsourcing on the record.
Cloud and outsourcing: how the risk develops.
Concentration and resilience. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Shared responsibility is misread
Cloud providers secure the platform; customers secure their configuration and data. Misunderstanding the split leaves gaps such as exposed storage.
Concentration across the sector
Many firms use the same few providers. An outage at one affects many firms at the same time.
Oversight depends on rights
Firms need audit, access and information rights in contracts. Without them, they cannot assess the provider or show supervisors they can.
Exit is slow
Moving a core service away from a provider can take years. Exit plans must be realistic and tested to be credible.
Settlement dependencies, and what fails with a node.
How a failure at one financial centre can spread through settlement links. Design links, not real dependencies.
What is measured, and how well.
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Material outsourcing arrangements | count | annual | Outsourcing registers | DECLARED |
| Critical services hosted on public cloud | share of critical services | annual | Firm and supervisory surveys | REPORTED |
| Contracts with full audit and access rights | share of material arrangements | periodic | Contract reviews | DECLARED |
| Cloud misconfiguration incidents | count | annual | Incident records | REPORTED |
| Exit plans tested | share of material arrangements | periodic | Firm records | DECLARED |
| Provider outages affecting financial firms | count and duration | annual | Incident reports | Published statistics |
Important business services.
The screen a team would use to follow this subject: its measures, states and decisions. Names are examples and values are illustrative.
Important business services
Cloud and outsourcing · Bank B services · Self-assessment 3
Services vs impact tolerance
| Make a payment | 3 | 1 | Cloud region loss | Outside |
| Access cash | 23 | 7 | Cyber attack | Within |
| Mortgage servicing | 49 | 39 | Data centre loss | Within |
| Claims payment | 26 | 70 | Third-party failure | Outside |
Dependency map
people · process · technology · third parties
Remediation
- R-1Second claims platform supplierExit plan tested93 d
- R-2Immutable backups for paymentsCyber recovery94 d
Where the evidence comes from.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| EBA guidelines on outsourcing arrangements | EU expectations for bank outsourcing | Free, EU reuse terms |
| PRA supervisory statement on outsourcing and third-party risk management | UK expectations | Free, Bank of England terms |
| FSB toolkit for third-party risk management and oversight | Common tools and terms | Free, FSB terms |
| DORA register of information requirements | EU register of ICT third-party arrangements | Free, EU reuse terms |
| Provider post-incident reports | Root causes of cloud outages | Free to read, terms per provider |
Trace a shock in cloud and outsourcing to the balance sheet.
Assembled from the Nexus Standards area profile Cyber resilience and digital operational resilience: the shocks it names, the systems and sectors that carry the loss, the controls that dampen it and the data that observe it. Pick an initiating shock and step through the cascade to see which exposures it reaches and where losses could concentrate. The Map view places the run on an example geography with open data. Every weight is a stated assumption. An exercise, not a forecast, a valuation, a rating or investment advice. To model a place of your own choosing, open the full System Builder.
Hazards
- Dam failure
- River flood (set off downstream)
- Flash flood (set off downstream)
- Mass displacement (set off downstream)
- Widespread power outage (set off downstream)
- Water supply shortfall (set off downstream)
Systems and couplings
Controls
NS-0Constitution and principlesNS-9Contextual UNIs (deployments, instances, programme instances)NS-10Policies and clauses (machine-readable obligations: definition, binding, evaluation and enforcement)NS-11Verification and monitoring (evidence, attestations, zero-trust conformance observation)NS-12Software, model and AI/ML artefacts (supply chain, model cards, dataset sheets)NRS-X6Cyber and digital security riskNRS-H54Hazard family: Signal and platform disruption (NHS-1 cyber.platform)NRS-P10Third-party, outsourcing and concentration riskNRS-H107Hazard family: Digital infrastructure concentration and monoculture (NHS-1 tech.digital-concentration)NRS-K31Domain pack profile: Cyber national resilience (DOMAIN-031)NRS-S7System profile: NXS-EOP (Earth observation and digital twins)
Observation
- Known Exploited Vulnerabilities catalogue (listed for reference)
- National Vulnerability Database (CVE enrichment API) (listed for reference)
- OSV open source vulnerability database (listed for reference)
- Proportion of population covered by a mobile network, by technology
Example geography
- North America: 243 hexagonal cells
- Night lights tonight, outages (VIIRS Day/Night Band), NASA GIBS
- Surface water through cloud, 30 m (OPERA DSWx-S1 radar), NASA GIBS
- Rain rate, last half hour (IMERG), NASA GIBS
- Surface soil moisture (SMAP), NASA GIBS
Who decides, and what the evidence serves.
Financial Cyber and Operational Resilience prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Boards and senior management | Which services to outsource and to whom | Risk assessments, contract terms and concentration evidence |
| Supervisors | Whether outsourcing governance is adequate | Registers and contract reviews |
| Procurement and vendor management | Which contract terms to require | Regulatory requirements and practice |
| Cloud and service providers | How to support customers' regulatory obligations | Regulatory expectations |
Outputs this topic produces
- Guide to the shared responsibility model
- Comparative notes on outsourcing rules
- Method note on exit planning and testing
- Questions for boards on material outsourcing
What cloud and outsourcing means for exposure, loss and capital.
The exposure, loss, scenario and capital views a risk officer, supervisor or ministry of finance would ask for, with the frameworks they report against. Structures follow supervisory and actuarial practice. Values are illustrative: never prices, ratings or advice.
Transmission channels
How a shock in cloud and outsourcing reaches credit, market, underwriting, liquidity and operational risk, and feeds back.
What concentration analysis asks.
- How many important services across the sector depend on the same provider, region or service?
- Can a firm exit a provider or switch to another in a crisis, and how long would it take?
- How visible are a provider's own dependencies, including its sub-contractors?
- How do contracts allocate responsibility for security, recovery and information during an incident?
Benefits and concentration.
Concentration is the paradox at the heart of this topic. Each firm moving to a well-run provider may become more resilient, while the sector as a whole becomes more dependent on that provider.
Scale and expertise
Large providers can invest in security and redundancy beyond what most firms can afford alone.
Shared failure
An outage or compromise at a major provider can affect many firms at once.
Exit difficulty
Proprietary services and data volumes make switching slow and costly.
How concentration is studied.
- 01
Dependency and concentration mapping
Aggregating which services rely on which providers, using network science. Limits: firm-level data is sensitive and incomplete.
- 02
Exit planning analysis
Studying feasibility of exit and substitution. Limits: plans are rarely tested at scale.
- 03
Contract review
Comparing contractual terms for audit, information and recovery. Limits: contracts are confidential.
- 04
Outage scenario analysis
Exploring provider failure scenarios, using resilience engineering. Limits: illustrative.
How it is studied, and what the methods cannot say.
- 01Reliability and resilience engineeringService and dependency mapping · Recovery strategy comparison · Learning reviewsApplied here
- 02Cybersecurity and cryptographyIdentity and privileged access · Detection and response capability · Threat-led testingApplied here
- 03Network science and contagionSector dependency maps · Outage propagation · Software component networksApplied here
Questions and answers.
What is the shared responsibility model?
What makes an outsourcing arrangement material?
Why test exit plans?
Is cloud less safe than in-house systems?
Can a firm outsource its accountability?
Does the platform name concentrated providers?
Is multi-cloud the answer to concentration?
Contribute evidence from this page.
Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
- EmailGateway GW-GRASend it from this pageEvidence, a correction, a case, a method, a review, a translation or profile input. It arrives tagged with this page, so the editor who owns it receives it.
- ZenodoOpen depositDeposit it and submit to the communityPublish your own record on Zenodo with your ORCID iD, then submit it to the Reports community there. Curators review it; the DOI stays yours.
- ReportsGlobal Risks AllianceSee every way to contributeThe contribution types, how each is reviewed, what credit you receive, the licence and what is never accepted.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
Bring an exposure or capital question to the Alliance.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.