DORA-Art29-P1

ICT Concentration Risk Assessment PARTIAL

Assessment of concentration risk arising from dependency on ICT third-party service providers, including single-provider dependencies, geographic concentration, and systemic risk analysis as required by DORA Article 31.

Formats: PDF
Evidence Class: concentration-risk-assessment
Availability: PARTIAL
Update Frequency: annual
Typical Author: Risk Manager
Approval Chain: Risk Manager → CRO → Board Risk Committee

Content Sections

Expected Fields

Common Quality Issues

Concentration risk assessment limited to direct providers
Subcontractor concentration not assessed
Geographic concentration analysis incomplete
Mitigation strategies generic without specific action plans

View Example

Generated example artifact using the default institution profile (COMMON availability, synthetic data only).

PLAIN_TEXT — Inline Preview

ICT CONCENTRATION RISK ASSESSMENT
Nordvik Bank AG
Assessment Reference: CRA-2025-001
Assessment Date: 28 January 2025
Prepared by: Elena Vasquez, Risk Manager — Third-Party ICT Risk
Approved by: Board Risk Committee, 5 February 2025
Classification: Confidential
Next Assessment: January 2026

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

EXECUTIVE SUMMARY

This assessment evaluates the concentration risk arising from Nordvik Bank AG's
("the Bank") dependency on ICT third-party service providers, as required by DORA
Article 31. The assessment covers all 15 ICT providers in the Bank's register and
analyses single-provider dependencies, geographic concentration, service
concentration, and systemic risk factors.

Key findings:
  — 4 providers classified as critical, supporting 11 of 14 critical business
    functions
  — 2 single-provider dependencies identified for critical services (core banking
    hosting and payment processing)
  — Geographic concentration in Frankfurt, Germany — 9 of 15 providers process
    data in Frankfurt
  — Cloud infrastructure concentration — 3 providers depend on AWS as a
    subcontractor
  — Overall concentration risk assessed as MODERATE, within the Bank's risk
    appetite but requiring active mitigation

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

PROVIDER DEPENDENCY ANALYSIS

Total ICT providers in register:           15
Critical providers:                         4
Important providers:                        4
Standard providers:                         7

Critical Provider Dependencies:

  Provider                        Critical Functions    Single-Provider
                                  Supported             Dependency?
  ─────────────────────────────────────────────────────────────────────────────
  Meridian Cloud Services GmbH    4                     YES — core banking
                                                        hosting has no
                                                        alternative provider
  SwiftPay Solutions B.V.         4                     YES — payment
                                                        processing has no
                                                        alternative provider
  Sentinel Cyber AG               3                     No — alternative SOC
                                                        providers identified
  AuditTrail Systems Ltd          3                     No — alternative PAM
                                                        providers identified

The Bank's two single-provider dependencies (Meridian Cloud and SwiftPay) represent
the highest concentration risk. Both providers support critical business functions
where service disruption would have severe operational and financial impact.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

GEOGRAPHIC CONCENTRATION

Data processing locations across all providers:

  Location              Providers    Critical Data    Risk Level
  ─────────────────────────────────────────────────────────────────────────────
  Frankfurt, Germany    9            Yes              HIGH — single geographic
                                                     point of failure for
                                                     majority of services
  Zurich, Switzerland   4            Yes              MODERATE
  Dublin, Ireland       3            Yes (DR)         LOW — DR only
  Amsterdam, NL         2            Yes              LOW
  London, GB            2            Yes              LOW
  Helsinki, Finland     1            No               LOW
  Luxembourg            2            No               LOW

Frankfurt represents a significant geographic concentration. A regional event
affecting the Frankfurt data centre ecosystem (power grid failure, natural
disaster, regulatory action) could simultaneously impact 9 of 15 providers.

The Bank's disaster recovery site in Dublin provides geographic diversification
for the core banking platform, but payment processing DR is also in Frankfurt
(different data centre), which does not provide adequate geographic separation.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

SERVICE CONCENTRATION

Analysis of service category concentration:

  Service Category          Providers    Concentration Risk
  ─────────────────────────────────────────────────────────────────────────────
  Cloud Infrastructure      1            HIGH — single provider (Meridian)
  Payment Processing        1            HIGH — single provider (SwiftPay)
  Security Operations       1            MODERATE — single provider but
                                         alternatives available
  Identity Management       1            MODERATE — single provider but
                                         alternatives available
  Regulatory Reporting      1            LOW — manual fallback available
  Communications            1            LOW — multiple alternatives

Subcontractor Concentration:

  Subcontractor             Used By         Concentration Risk
  ─────────────────────────────────────────────────────────────────────────────
  AWS                       3 providers     MODERATE — NordicSoft, SwiftPay,
                                            ComplianceDoc all depend on AWS
  Equinix                   1 provider      LOW — colocation only
  CrowdStrike               1 provider      LOW — EDR platform

The AWS subcontractor concentration is notable: if AWS eu-central-1 experienced
a prolonged outage, three of the Bank's providers could be simultaneously
affected, including the payment processing secondary site.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

SYSTEMIC RISK ASSESSMENT

Systemic risk factors considered:

  1. Market dominance: Meridian Cloud Services serves 12 other mid-size banks
     in the DACH region. A failure of Meridian could trigger simultaneous
     disruption across multiple financial entities.

  2. Regulatory designation: SwiftPay Solutions is under consideration for
     designation as a critical ICT third-party service provider under DORA
     Article 31, given its market share in EU payment processing.

  3. Technology monoculture: The Bank's reliance on VMware virtualisation
     (via Meridian) creates a technology concentration risk — a critical
     VMware vulnerability could affect the entire production environment.

  4. Geopolitical risk: All critical providers are domiciled in EU/EEA/CH
     jurisdictions, mitigating cross-border regulatory risk. However, the
     CrowdStrike dependency (US-headquartered) introduces potential data
     sovereignty considerations.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

MITIGATION STRATEGIES

  #   Risk Area                  Mitigation Action                    Target Date
  ─────────────────────────────────────────────────────────────────────────────
  1   Core banking hosting       Develop multi-cloud exit strategy    Q3 2025
      single-provider            with alternative provider shortlist
      dependency

  2   Payment processing         Engage secondary payment processor   Q4 2025
      single-provider            for card acquiring (active-passive
      dependency                 configuration)

  3   Frankfurt geographic       Migrate payment processing DR to     Q2 2025
      concentration              Amsterdam or Dublin site

  4   AWS subcontractor          Require providers to document AWS    Q2 2025
      concentration              dependency and fallback arrangements

  5   VMware technology          Evaluate container-based workload    Q4 2025
      monoculture                migration to reduce VMware
                                 dependency

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

MONITORING PLAN

Concentration risk indicators will be monitored quarterly:
  — Provider dependency ratio (critical functions per provider)
  — Geographic concentration index (Herfindahl-Hirschman Index by location)
  — Subcontractor overlap count
  — Single-provider dependency count
  — Provider financial health indicators

Thresholds triggering escalation to the Board Risk Committee:
  — Any new single-provider dependency for a critical service
  — Geographic concentration index exceeding 0.35
  — Provider financial distress indicators (credit rating downgrade, material
    litigation, regulatory enforcement action)

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Prepared by: Elena Vasquez, Risk Manager
Reviewed by: CRO
Approved by: Board Risk Committee
Date: 5 February 2025

Expected Structured Facts

Example structured facts that Detrixa would extract from this evidence (synthetic data, deterministic seed).

concentration_risk_assessment_status — fs-concentration-risk-assessment

{
  "factId": "f5a6b7c8-d9e0-1234-fabc-456789012345",
  "evidenceId": "e4f5a6b7-c8d9-0123-4567-890123abcdef",
  "evidenceClassId": "concentration-risk-assessment",
  "factType": "concentration_risk_assessment_status",
  "data": {
    "assessment_date": "2025-01-28",
    "total_providers_assessed": 15,
    "single_provider_dependencies": 2,
    "geographic_concentrations_identified": 1,
    "service_concentrations_identified": 2,
    "mitigation_actions_defined": 5,
    "mitigation_actions_implemented": 2,
    "concentration_risk_within_tolerance": true
  },
  "provenance": "deterministic",
  "extractorVersion": "dora-test-generator/0.1.0",
  "extractedAt": "2025-01-29T14:00:00Z",
  "supersededBy": null
}

ict_provider_register_status — fs-ict-provider-register

{
  "factId": "b1c2d3e4-f5a6-7890-bcde-f12345678901",
  "evidenceId": "a0b1c2d3-e4f5-6789-0123-456789abcde0",
  "evidenceClassId": "ict-provider-register",
  "factType": "ict_provider_register_status",
  "data": {
    "register_date": "2025-01-15",
    "total_providers": 15,
    "critical_providers": 4,
    "providers_with_contracts": 15,
    "providers_with_criticality_assessment": 12,
    "data_locations_documented": true,
    "subcontractors_documented": true,
    "last_full_review_date": "2025-01-15"
  },
  "provenance": "deterministic",
  "extractorVersion": "dora-test-generator/0.1.0",
  "extractedAt": "2025-01-16T10:00:00Z",
  "supersededBy": null
}

ICT Third-Party Service Provider Register COMMON

CSV register of all ICT third-party service providers with contractual arrangement details, service descriptions, criticality assessments, and data processing locations as required by DORA Article 28(3).

Formats: CSV JSON
Evidence Class: ict-provider-register
Availability: COMMON
Update Frequency: quarterly
Typical Author: Vendor Management Officer
Approval Chain: Vendor Management Officer → CRO

Content Sections

Expected Fields

Common Quality Issues

Register incomplete — missing shadow IT providers
Criticality assessments not performed for all providers
Data processing locations not verified
Subcontractor chains not fully documented

View Example

Generated example artifact using the default institution profile (COMMON availability, synthetic data only).

CSV — Inline Preview

provider_id,provider_name,service_description,contract_start_date,contract_end_date,criticality_level,data_processing_locations,subcontractors,annual_cost_eur
PRV-001,Meridian Cloud Services GmbH,Core banking infrastructure hosting — IaaS platform providing compute and storage for Temenos T24 and Oracle Database environments,2021-03-01,2026-02-28,Critical,"Frankfurt DE, Dublin IE","Equinix (colocation), Cloudflare (CDN)",2450000
PRV-002,Sentinel Cyber AG,Managed Security Operations Centre — 24/7 SIEM monitoring and endpoint detection and response services,2022-06-15,2025-06-14,Critical,"Zurich CH, Vienna AT",CrowdStrike (EDR platform),890000
PRV-003,SwiftPay Solutions B.V.,Payment processing gateway — card acquiring and SEPA payment processing services,2020-01-01,2025-12-31,Critical,"Amsterdam NL, Frankfurt DE","Worldline (card network connectivity), AWS (secondary processing)",1750000
PRV-004,DataVault Storage Ltd,Offsite backup and disaster recovery — encrypted backup replication and DR site hosting,2023-01-15,2028-01-14,Critical,"Geneva CH, Luxembourg LU",None,620000
PRV-005,NordicSoft Oy,Regulatory reporting platform — automated regulatory return generation and submission for FINMA and ECB,2022-09-01,2025-08-31,Important,"Helsinki FI, Frankfurt DE",AWS (hosting),340000
PRV-006,CloudComm SaaS Ltd,Unified communications platform — email and collaboration services including Microsoft 365 and Teams,2021-07-01,2026-06-30,Important,"Dublin IE, Amsterdam NL",Microsoft (underlying platform),285000
PRV-007,ThreatIntel Partners GmbH,Cyber threat intelligence — threat feed aggregation and analysis for financial sector threats,2024-01-01,2026-12-31,Standard,"Berlin DE",None,95000
PRV-008,ComplianceDoc AG,Document management system — secure storage and workflow for compliance documentation,2023-04-01,2026-03-31,Standard,"Zurich CH",AWS (hosting),120000
PRV-009,AnalyticsPro S.A.,Business intelligence and data analytics — data warehouse and reporting platform,2022-11-01,2025-10-31,Important,"Luxembourg LU, Frankfurt DE","Snowflake (data platform), Tableau (visualisation)",410000
PRV-010,AuditTrail Systems Ltd,Identity and access management — privileged access management and single sign-on services,2023-08-01,2026-07-31,Critical,"London GB, Frankfurt DE",CyberArk (PAM platform),530000
PRV-011,NetGuard Telecom AG,Wide area network connectivity — MPLS and SD-WAN services connecting branch offices and data centres,2020-06-01,2025-05-31,Important,"Zurich CH, Bern CH",Swisscom (last-mile connectivity),375000
PRV-012,InsurTech Data Services GmbH,Anti-money laundering screening — transaction monitoring and sanctions screening services,2021-02-01,2026-01-31,Critical,"Munich DE, Frankfurt DE",NICE Actimize (screening engine),680000
PRV-013,PrintSecure B.V.,Secure printing and document distribution — customer statement printing and postal distribution,2022-03-15,2025-03-14,Standard,"Rotterdam NL",PostNL (postal distribution),85000
PRV-014,DevOps Tooling SaaS Inc,Software development platform — CI/CD pipeline and code repository hosting,2024-03-01,2027-02-28,Standard,"Dublin IE, Oregon US",GitHub (underlying platform),62000
PRV-015,BankingAPI Connect Ltd,Open banking API gateway — PSD2-compliant API management and third-party provider connectivity,2023-06-01,2026-05-31,Important,"London GB, Frankfurt DE","AWS (hosting), Kong (API gateway)",290000

Expected Structured Facts

Example structured facts that Detrixa would extract from this evidence (synthetic data, deterministic seed).

concentration_risk_assessment_status — fs-concentration-risk-assessment

{
  "factId": "f5a6b7c8-d9e0-1234-fabc-456789012345",
  "evidenceId": "e4f5a6b7-c8d9-0123-4567-890123abcdef",
  "evidenceClassId": "concentration-risk-assessment",
  "factType": "concentration_risk_assessment_status",
  "data": {
    "assessment_date": "2025-01-28",
    "total_providers_assessed": 15,
    "single_provider_dependencies": 2,
    "geographic_concentrations_identified": 1,
    "service_concentrations_identified": 2,
    "mitigation_actions_defined": 5,
    "mitigation_actions_implemented": 2,
    "concentration_risk_within_tolerance": true
  },
  "provenance": "deterministic",
  "extractorVersion": "dora-test-generator/0.1.0",
  "extractedAt": "2025-01-29T14:00:00Z",
  "supersededBy": null
}

ict_provider_register_status — fs-ict-provider-register

{
  "factId": "b1c2d3e4-f5a6-7890-bcde-f12345678901",
  "evidenceId": "a0b1c2d3-e4f5-6789-0123-456789abcde0",
  "evidenceClassId": "ict-provider-register",
  "factType": "ict_provider_register_status",
  "data": {
    "register_date": "2025-01-15",
    "total_providers": 15,
    "critical_providers": 4,
    "providers_with_contracts": 15,
    "providers_with_criticality_assessment": 12,
    "data_locations_documented": true,
    "subcontractors_documented": true,
    "last_full_review_date": "2025-01-15"
  },
  "provenance": "deterministic",
  "extractorVersion": "dora-test-generator/0.1.0",
  "extractedAt": "2025-01-16T10:00:00Z",
  "supersededBy": null
}

concentration_risk_assessment_status

Schema ID: fs-concentration-risk-assessment
Control: DORA-Art31-P1

Valid Ranges

assessment_date: within last 12 months
single_provider_dependencies: should be minimised for critical services

Related Schemas

JSON Schema

{
  "properties": {
    "assessment_date": {
      "format": "date",
      "type": "string"
    },
    "concentration_risk_within_tolerance": {
      "type": "boolean"
    },
    "geographic_concentrations_identified": {
      "minimum": 0,
      "type": "integer"
    },
    "mitigation_actions_defined": {
      "minimum": 0,
      "type": "integer"
    },
    "mitigation_actions_implemented": {
      "minimum": 0,
      "type": "integer"
    },
    "service_concentrations_identified": {
      "minimum": 0,
      "type": "integer"
    },
    "single_provider_dependencies": {
      "minimum": 0,
      "type": "integer"
    },
    "total_providers_assessed": {
      "minimum": 0,
      "type": "integer"
    }
  },
  "required": [
    "assessment_date",
    "total_providers_assessed",
    "single_provider_dependencies",
    "geographic_concentrations_identified"
  ],
  "type": "object"
}

ict_provider_register_status

Schema ID: fs-ict-provider-register
Control: DORA-Art28-P3

Valid Ranges

register_date: within last 3 months
providers_with_contracts: should equal total_providers for full compliance
providers_with_criticality_assessment: should equal total_providers

Related Schemas

JSON Schema

{
  "properties": {
    "critical_providers": {
      "minimum": 0,
      "type": "integer"
    },
    "data_locations_documented": {
      "type": "boolean"
    },
    "last_full_review_date": {
      "format": "date",
      "type": "string"
    },
    "providers_with_contracts": {
      "minimum": 0,
      "type": "integer"
    },
    "providers_with_criticality_assessment": {
      "minimum": 0,
      "type": "integer"
    },
    "register_date": {
      "format": "date",
      "type": "string"
    },
    "subcontractors_documented": {
      "type": "boolean"
    },
    "total_providers": {
      "minimum": 0,
      "type": "integer"
    }
  },
  "required": [
    "register_date",
    "total_providers",
    "critical_providers",
    "providers_with_contracts"
  ],
  "type": "object"
}

Evidence Profiles

ICT Concentration Risk Assessment PARTIAL

Content Sections

Expected Fields

Common Quality Issues

View Example

Expected Structured Facts

ICT Third-Party Service Provider Register COMMON

Content Sections

Expected Fields

Common Quality Issues

View Example

Expected Structured Facts

Fact Schemas

concentration_risk_assessment_status

Valid Ranges

Related Schemas

JSON Schema

ict_provider_register_status

Valid Ranges

Related Schemas

JSON Schema