Financial entities shall assess the concentration risk arising from the use of ICT services provided by ICT third-party service providers, taking into account the degree of substitutability of the ICT third-party service providers.
Assessment of concentration risk arising from dependency on ICT third-party service providers, including single-provider dependencies, geographic concentration, and systemic risk analysis as required by DORA Article 31.
concentration-risk-assessmentGenerated example artifact using the default institution profile (COMMON availability, synthetic data only).
ICT CONCENTRATION RISK ASSESSMENT
Nordvik Bank AG
Assessment Reference: CRA-2025-001
Assessment Date: 28 January 2025
Prepared by: Elena Vasquez, Risk Manager — Third-Party ICT Risk
Approved by: Board Risk Committee, 5 February 2025
Classification: Confidential
Next Assessment: January 2026
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
EXECUTIVE SUMMARY
This assessment evaluates the concentration risk arising from Nordvik Bank AG's
("the Bank") dependency on ICT third-party service providers, as required by DORA
Article 31. The assessment covers all 15 ICT providers in the Bank's register and
analyses single-provider dependencies, geographic concentration, service
concentration, and systemic risk factors.
Key findings:
— 4 providers classified as critical, supporting 11 of 14 critical business
functions
— 2 single-provider dependencies identified for critical services (core banking
hosting and payment processing)
— Geographic concentration in Frankfurt, Germany — 9 of 15 providers process
data in Frankfurt
— Cloud infrastructure concentration — 3 providers depend on AWS as a
subcontractor
— Overall concentration risk assessed as MODERATE, within the Bank's risk
appetite but requiring active mitigation
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
PROVIDER DEPENDENCY ANALYSIS
Total ICT providers in register: 15
Critical providers: 4
Important providers: 4
Standard providers: 7
Critical Provider Dependencies:
Provider Critical Functions Single-Provider
Supported Dependency?
─────────────────────────────────────────────────────────────────────────────
Meridian Cloud Services GmbH 4 YES — core banking
hosting has no
alternative provider
SwiftPay Solutions B.V. 4 YES — payment
processing has no
alternative provider
Sentinel Cyber AG 3 No — alternative SOC
providers identified
AuditTrail Systems Ltd 3 No — alternative PAM
providers identified
The Bank's two single-provider dependencies (Meridian Cloud and SwiftPay) represent
the highest concentration risk. Both providers support critical business functions
where service disruption would have severe operational and financial impact.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
GEOGRAPHIC CONCENTRATION
Data processing locations across all providers:
Location Providers Critical Data Risk Level
─────────────────────────────────────────────────────────────────────────────
Frankfurt, Germany 9 Yes HIGH — single geographic
point of failure for
majority of services
Zurich, Switzerland 4 Yes MODERATE
Dublin, Ireland 3 Yes (DR) LOW — DR only
Amsterdam, NL 2 Yes LOW
London, GB 2 Yes LOW
Helsinki, Finland 1 No LOW
Luxembourg 2 No LOW
Frankfurt represents a significant geographic concentration. A regional event
affecting the Frankfurt data centre ecosystem (power grid failure, natural
disaster, regulatory action) could simultaneously impact 9 of 15 providers.
The Bank's disaster recovery site in Dublin provides geographic diversification
for the core banking platform, but payment processing DR is also in Frankfurt
(different data centre), which does not provide adequate geographic separation.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
SERVICE CONCENTRATION
Analysis of service category concentration:
Service Category Providers Concentration Risk
─────────────────────────────────────────────────────────────────────────────
Cloud Infrastructure 1 HIGH — single provider (Meridian)
Payment Processing 1 HIGH — single provider (SwiftPay)
Security Operations 1 MODERATE — single provider but
alternatives available
Identity Management 1 MODERATE — single provider but
alternatives available
Regulatory Reporting 1 LOW — manual fallback available
Communications 1 LOW — multiple alternatives
Subcontractor Concentration:
Subcontractor Used By Concentration Risk
─────────────────────────────────────────────────────────────────────────────
AWS 3 providers MODERATE — NordicSoft, SwiftPay,
ComplianceDoc all depend on AWS
Equinix 1 provider LOW — colocation only
CrowdStrike 1 provider LOW — EDR platform
The AWS subcontractor concentration is notable: if AWS eu-central-1 experienced
a prolonged outage, three of the Bank's providers could be simultaneously
affected, including the payment processing secondary site.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
SYSTEMIC RISK ASSESSMENT
Systemic risk factors considered:
1. Market dominance: Meridian Cloud Services serves 12 other mid-size banks
in the DACH region. A failure of Meridian could trigger simultaneous
disruption across multiple financial entities.
2. Regulatory designation: SwiftPay Solutions is under consideration for
designation as a critical ICT third-party service provider under DORA
Article 31, given its market share in EU payment processing.
3. Technology monoculture: The Bank's reliance on VMware virtualisation
(via Meridian) creates a technology concentration risk — a critical
VMware vulnerability could affect the entire production environment.
4. Geopolitical risk: All critical providers are domiciled in EU/EEA/CH
jurisdictions, mitigating cross-border regulatory risk. However, the
CrowdStrike dependency (US-headquartered) introduces potential data
sovereignty considerations.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
MITIGATION STRATEGIES
# Risk Area Mitigation Action Target Date
─────────────────────────────────────────────────────────────────────────────
1 Core banking hosting Develop multi-cloud exit strategy Q3 2025
single-provider with alternative provider shortlist
dependency
2 Payment processing Engage secondary payment processor Q4 2025
single-provider for card acquiring (active-passive
dependency configuration)
3 Frankfurt geographic Migrate payment processing DR to Q2 2025
concentration Amsterdam or Dublin site
4 AWS subcontractor Require providers to document AWS Q2 2025
concentration dependency and fallback arrangements
5 VMware technology Evaluate container-based workload Q4 2025
monoculture migration to reduce VMware
dependency
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
MONITORING PLAN
Concentration risk indicators will be monitored quarterly:
— Provider dependency ratio (critical functions per provider)
— Geographic concentration index (Herfindahl-Hirschman Index by location)
— Subcontractor overlap count
— Single-provider dependency count
— Provider financial health indicators
Thresholds triggering escalation to the Board Risk Committee:
— Any new single-provider dependency for a critical service
— Geographic concentration index exceeding 0.35
— Provider financial distress indicators (credit rating downgrade, material
litigation, regulatory enforcement action)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Prepared by: Elena Vasquez, Risk Manager
Reviewed by: CRO
Approved by: Board Risk Committee
Date: 5 February 2025
Example structured facts that Detrixa would extract from this evidence (synthetic data, deterministic seed).
concentration_risk_assessment_status — fs-concentration-risk-assessment
{
"factId": "f5a6b7c8-d9e0-1234-fabc-456789012345",
"evidenceId": "e4f5a6b7-c8d9-0123-4567-890123abcdef",
"evidenceClassId": "concentration-risk-assessment",
"factType": "concentration_risk_assessment_status",
"data": {
"assessment_date": "2025-01-28",
"total_providers_assessed": 15,
"single_provider_dependencies": 2,
"geographic_concentrations_identified": 1,
"service_concentrations_identified": 2,
"mitigation_actions_defined": 5,
"mitigation_actions_implemented": 2,
"concentration_risk_within_tolerance": true
},
"provenance": "deterministic",
"extractorVersion": "dora-test-generator/0.1.0",
"extractedAt": "2025-01-29T14:00:00Z",
"supersededBy": null
}
substitutability_analysis_status — fs-substitutability-analysis
{
"factId": "a6b7c8d9-e0f1-2345-abcd-567890123456",
"evidenceId": "f5a6b7c8-d9e0-1234-5678-901234abcdef",
"evidenceClassId": "substitutability-analysis",
"factType": "substitutability_analysis_status",
"data": {
"provider_id": "PRV-001",
"analysis_date": "2025-01-25",
"substitutability_rating": "difficult_to_substitute",
"alternative_providers_identified": 3,
"estimated_switching_cost_eur": 3200000,
"estimated_transition_months": 18,
"data_portability_feasible": true
},
"provenance": "deterministic",
"extractorVersion": "dora-test-generator/0.1.0",
"extractedAt": "2025-01-26T10:30:00Z",
"supersededBy": null
}
XML-structured analysis of the substitutability of ICT third-party service providers, including alternative provider identification, switching costs, and transition feasibility as required by DORA Articles 31-32.
substitutability-analysisGenerated example artifact using the default institution profile (COMMON availability, synthetic data only).
<?xml version="1.0" encoding="UTF-8"?>
<SubstitutabilityAnalysis
analysisId="SA-2025-001"
institution="Nordvik Bank AG"
analysisDate="2025-01-25"
preparedBy="Thomas Richter, Enterprise Architect"
approvedBy="CIO, CRO"
regulatoryBasis="DORA Articles 31-32"
nextReviewDate="2026-01-25">
<!-- ═══════════════════════════════════════════════════════════════════════
CRITICAL PROVIDER: Meridian Cloud Services GmbH
Service: Core banking infrastructure hosting (IaaS)
═══════════════════════════════════════════════════════════════════════ -->
<ProviderAnalysis providerId="PRV-001" providerName="Meridian Cloud Services GmbH">
<ServiceDescription>Core banking infrastructure hosting — IaaS platform
providing compute, storage, and managed database services for Temenos T24
and Oracle Database environments.</ServiceDescription>
<CriticalityLevel>critical</CriticalityLevel>
<CurrentContractEnd>2026-02-28</CurrentContractEnd>
<AnnualCostEur>2450000</AnnualCostEur>
<SubstitutabilityRating>difficult_to_substitute</SubstitutabilityRating>
<RatingJustification>Deep integration with Temenos T24 core banking system
requiring specialised hosting configuration. Provider has 8 years of
financial-grade hosting experience. Migration would require significant
re-architecture of database replication and backup procedures.
</RatingJustification>
<AlternativeProviders count="3">
<Provider name="AWS Financial Services (eu-central-1)"
capabilityMatch="high"
certifications="ISO 27001, SOC 2, PCI-DSS, C5"
financialGradeExperience="yes"
notes="Would require migration from VMware to EC2/EKS. Temenos offers AWS-native deployment." />
<Provider name="Swisscom Enterprise Cloud"
capabilityMatch="medium"
certifications="ISO 27001, SOC 2, FINMA-compliant"
financialGradeExperience="yes"
notes="Swiss-domiciled. Smaller scale than Meridian. Would require capacity validation." />
<Provider name="T-Systems Sovereign Cloud"
capabilityMatch="medium"
certifications="ISO 27001, SOC 2, C5, BSI"
financialGradeExperience="yes"
notes="German sovereign cloud offering. Strong regulatory compliance. Limited Temenos hosting experience." />
</AlternativeProviders>
<SwitchingAssessment>
<EstimatedSwitchingCostEur>3200000</EstimatedSwitchingCostEur>
<EstimatedTransitionMonths>18</EstimatedTransitionMonths>
<DataPortabilityFeasible>true</DataPortabilityFeasible>
<DataPortabilityNotes>Database export/import feasible via Oracle Data Pump.
Application configuration requires manual migration. Backup history
non-portable — fresh baseline required at new provider.</DataPortabilityNotes>
<KeyRisks>
<Risk severity="high">Extended parallel-run period required (6+ months)
to validate performance and stability at new provider.</Risk>
<Risk severity="high">Temenos T24 recertification required for new
hosting environment — estimated 3 months.</Risk>
<Risk severity="medium">Staff retraining on new provider management
interfaces and operational procedures.</Risk>
<Risk severity="low">Temporary increase in operational complexity
during dual-provider period.</Risk>
</KeyRisks>
</SwitchingAssessment>
<TransitionFeasibility>
<OverallFeasibility>feasible_with_significant_effort</OverallFeasibility>
<PrerequisiteActions>
<Action>Complete containerisation of non-database workloads (in progress)</Action>
<Action>Negotiate Temenos cloud-native deployment licence</Action>
<Action>Establish DR capability at alternative provider before primary migration</Action>
<Action>Conduct proof-of-concept migration of non-production environment</Action>
</PrerequisiteActions>
</TransitionFeasibility>
</ProviderAnalysis>
<!-- ═══════════════════════════════════════════════════════════════════════
CRITICAL PROVIDER: SwiftPay Solutions B.V.
Service: Payment processing gateway
═══════════════════════════════════════════════════════════════════════ -->
<ProviderAnalysis providerId="PRV-003" providerName="SwiftPay Solutions B.V.">
<ServiceDescription>Payment processing gateway — card acquiring, SEPA credit
transfers, SEPA direct debits, and instant payment processing.</ServiceDescription>
<CriticalityLevel>critical</CriticalityLevel>
<CurrentContractEnd>2025-12-31</CurrentContractEnd>
<AnnualCostEur>1750000</AnnualCostEur>
<SubstitutabilityRating>difficult_to_substitute</SubstitutabilityRating>
<RatingJustification>Payment processing requires PCI-DSS Level 1 certification
and direct card network connectivity (Visa, Mastercard). Provider handles
SEPA scheme participation on behalf of the Bank. Switching requires
re-certification and scheme migration.</RatingJustification>
<AlternativeProviders count="2">
<Provider name="Worldline S.A."
capabilityMatch="high"
certifications="PCI-DSS Level 1, ISO 27001"
financialGradeExperience="yes"
notes="Major EU payment processor. Full SEPA and card acquiring capability. Already a subcontractor to SwiftPay." />
<Provider name="Nexi S.p.A."
capabilityMatch="medium"
certifications="PCI-DSS Level 1, ISO 27001"
financialGradeExperience="yes"
notes="Strong in Southern European market. Expanding DACH presence. Would require API integration rework." />
</AlternativeProviders>
<SwitchingAssessment>
<EstimatedSwitchingCostEur>1800000</EstimatedSwitchingCostEur>
<EstimatedTransitionMonths>12</EstimatedTransitionMonths>
<DataPortabilityFeasible>true</DataPortabilityFeasible>
<DataPortabilityNotes>Transaction history exportable in ISO 20022 format.
Recurring payment mandates require individual migration. Card tokenisation
vault non-portable — re-tokenisation required.</DataPortabilityNotes>
<KeyRisks>
<Risk severity="high">Card scheme re-certification process (Visa, Mastercard)
— estimated 4-6 months.</Risk>
<Risk severity="high">SEPA scheme participant migration — requires ECB
notification and 3-month transition period.</Risk>
<Risk severity="medium">Customer-facing payment disruption during
cutover window.</Risk>
<Risk severity="medium">Re-tokenisation of stored card data — customer
impact for recurring payments.</Risk>
</KeyRisks>
</SwitchingAssessment>
<TransitionFeasibility>
<OverallFeasibility>feasible_with_significant_effort</OverallFeasibility>
<PrerequisiteActions>
<Action>Initiate card scheme pre-qualification with alternative provider</Action>
<Action>Implement payment gateway abstraction layer to reduce direct integration</Action>
<Action>Negotiate SEPA scheme migration timeline with national central bank</Action>
<Action>Develop customer communication plan for payment method re-registration</Action>
</PrerequisiteActions>
</TransitionFeasibility>
</ProviderAnalysis>
<!-- ═══════════════════════════════════════════════════════════════════════
CRITICAL PROVIDER: Sentinel Cyber AG
Service: Managed Security Operations Centre
═══════════════════════════════════════════════════════════════════════ -->
<ProviderAnalysis providerId="PRV-002" providerName="Sentinel Cyber AG">
<ServiceDescription>Managed Security Operations Centre — 24/7 SIEM monitoring,
endpoint detection and response, and threat intelligence services.</ServiceDescription>
<CriticalityLevel>critical</CriticalityLevel>
<CurrentContractEnd>2025-06-14</CurrentContractEnd>
<AnnualCostEur>890000</AnnualCostEur>
<SubstitutabilityRating>substitutable_with_effort</SubstitutabilityRating>
<RatingJustification>Managed SOC services are available from multiple providers
in the EU market. SIEM correlation rules and detection logic are
provider-specific but can be recreated. EDR platform (CrowdStrike) is
provider-independent and can be retained.</RatingJustification>
<AlternativeProviders count="3">
<Provider name="Atos Cybersecurity Services"
capabilityMatch="high"
certifications="ISO 27001, SOC 2"
financialGradeExperience="yes"
notes="Large-scale managed SOC with financial sector specialisation." />
<Provider name="Kudelski Security"
capabilityMatch="high"
certifications="ISO 27001, SOC 2"
financialGradeExperience="yes"
notes="Swiss-based. Strong in DACH financial sector." />
<Provider name="Orange Cyberdefense"
capabilityMatch="medium"
certifications="ISO 27001"
financialGradeExperience="yes"
notes="Pan-European coverage. Growing financial sector practice." />
</AlternativeProviders>
<SwitchingAssessment>
<EstimatedSwitchingCostEur>450000</EstimatedSwitchingCostEur>
<EstimatedTransitionMonths>6</EstimatedTransitionMonths>
<DataPortabilityFeasible>true</DataPortabilityFeasible>
<DataPortabilityNotes>SIEM log data exportable in standard formats (CEF, LEEF).
Correlation rules require manual recreation. Historical incident data
exportable in JSON format.</DataPortabilityNotes>
<KeyRisks>
<Risk severity="medium">Detection capability gap during SIEM rule tuning
period (estimated 2-3 months).</Risk>
<Risk severity="medium">Loss of institutional knowledge about Bank-specific
threat patterns.</Risk>
<Risk severity="low">Temporary increase in false positive rate during
tuning period.</Risk>
</KeyRisks>
</SwitchingAssessment>
<TransitionFeasibility>
<OverallFeasibility>feasible_with_moderate_effort</OverallFeasibility>
<PrerequisiteActions>
<Action>Document all custom SIEM correlation rules and detection logic</Action>
<Action>Export historical incident data and threat intelligence</Action>
<Action>Negotiate parallel-run period with both providers (2 months)</Action>
</PrerequisiteActions>
</TransitionFeasibility>
</ProviderAnalysis>
</SubstitutabilityAnalysis>
Example structured facts that Detrixa would extract from this evidence (synthetic data, deterministic seed).
concentration_risk_assessment_status — fs-concentration-risk-assessment
{
"factId": "f5a6b7c8-d9e0-1234-fabc-456789012345",
"evidenceId": "e4f5a6b7-c8d9-0123-4567-890123abcdef",
"evidenceClassId": "concentration-risk-assessment",
"factType": "concentration_risk_assessment_status",
"data": {
"assessment_date": "2025-01-28",
"total_providers_assessed": 15,
"single_provider_dependencies": 2,
"geographic_concentrations_identified": 1,
"service_concentrations_identified": 2,
"mitigation_actions_defined": 5,
"mitigation_actions_implemented": 2,
"concentration_risk_within_tolerance": true
},
"provenance": "deterministic",
"extractorVersion": "dora-test-generator/0.1.0",
"extractedAt": "2025-01-29T14:00:00Z",
"supersededBy": null
}
substitutability_analysis_status — fs-substitutability-analysis
{
"factId": "a6b7c8d9-e0f1-2345-abcd-567890123456",
"evidenceId": "f5a6b7c8-d9e0-1234-5678-901234abcdef",
"evidenceClassId": "substitutability-analysis",
"factType": "substitutability_analysis_status",
"data": {
"provider_id": "PRV-001",
"analysis_date": "2025-01-25",
"substitutability_rating": "difficult_to_substitute",
"alternative_providers_identified": 3,
"estimated_switching_cost_eur": 3200000,
"estimated_transition_months": 18,
"data_portability_feasible": true
},
"provenance": "deterministic",
"extractorVersion": "dora-test-generator/0.1.0",
"extractedAt": "2025-01-26T10:30:00Z",
"supersededBy": null
}
fs-concentration-risk-assessmentDORA-Art31-P1assessment_datesingle_provider_dependencies{
"properties": {
"assessment_date": {
"format": "date",
"type": "string"
},
"concentration_risk_within_tolerance": {
"type": "boolean"
},
"geographic_concentrations_identified": {
"minimum": 0,
"type": "integer"
},
"mitigation_actions_defined": {
"minimum": 0,
"type": "integer"
},
"mitigation_actions_implemented": {
"minimum": 0,
"type": "integer"
},
"service_concentrations_identified": {
"minimum": 0,
"type": "integer"
},
"single_provider_dependencies": {
"minimum": 0,
"type": "integer"
},
"total_providers_assessed": {
"minimum": 0,
"type": "integer"
}
},
"required": [
"assessment_date",
"total_providers_assessed",
"single_provider_dependencies",
"geographic_concentrations_identified"
],
"type": "object"
}
fs-substitutability-analysisDORA-Art31-P1analysis_datealternative_providers_identified{
"properties": {
"alternative_providers_identified": {
"minimum": 0,
"type": "integer"
},
"analysis_date": {
"format": "date",
"type": "string"
},
"data_portability_feasible": {
"type": "boolean"
},
"estimated_switching_cost_eur": {
"minimum": 0,
"type": "number"
},
"estimated_transition_months": {
"minimum": 0,
"type": "integer"
},
"provider_id": {
"minLength": 1,
"type": "string"
},
"substitutability_rating": {
"enum": [
"easily_substitutable",
"substitutable_with_effort",
"difficult_to_substitute",
"not_substitutable"
],
"type": "string"
}
},
"required": [
"provider_id",
"analysis_date",
"substitutability_rating",
"alternative_providers_identified"
],
"type": "object"
}