thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Advanced

Concentration Risk

Risk from heavy dependence on a single vendor, provider, region, or technology whose failure would have outsized impact.

Definition

Concentration risk arises when critical services rely on one cloud provider or when many vendors share a common fourth party. Mitigations include multi-vendor strategies, exit plans, portability, and resilience testing. Financial regulators, including under DORA, require monitoring of ICT concentration risk.

Example

Most of a bank's critical applications run in a single cloud region, creating concentration risk.

Exam tip

Exit strategies and substitutability are the main controls for concentration risk.

Related terms