What it asks for. When identifying and assessing ICT risk before contracting ICT services that support critical or important functions, financial entities must consider whether the arrangement would lead to contracting a provider that is not easily substitutable, or to multiple contracts with the same or closely connected providers.
In practice. Entities weigh the benefits and costs of alternative solutions, such as using different providers. Where arrangements allow subcontracting of services supporting critical or important functions, the entity assesses the risks of potential long or complex subcontracting chains and, for providers in third countries, insolvency law provisions and constraints on the urgent recovery of data. Doing this well means a documented concentration assessment in the pre-contract process, informed by the register of information, with substitutability and exit options recorded. Evidence includes assessment records and board-level visibility of concentration exposures.
Common gaps. Common gaps are assessing concentration only per contract rather than across the group, ignoring fourth parties behind the provider, and accepting dependence on a hyperscaler without a credible exit plan.