DEPENDENCY & CONCENTRATION RISK

Single points of failure and systemic concentration — one provider, one platform, one team — aren't mapped, so a single failure can cascade across services. The concentration is invisible until it bites.

Actors

  • Head of Cyber Resilience
  • Risk Owners
  • IT & Infra Leads

Systems / Vendors

  • CMDB / service mapping
  • TPRM
  • Asset / identity graph

Business Question

"Where is a single provider, platform or team a hidden single point of failure across our services?"

What SPoG Does

  • Identifies single points of failure and systemic concentration risk.
  • Maps where one failure cascades across services.
  • Prioritises where to build redundancy.

Outcome Metrics

1

Concentration-risk map

−25%

Systemic exposure

6–10 wks

To first outcomes