Mapped but Not Governed: Third-Party Dependency and the Board's Resilience Obligation

I. ONE FAULTY UPDATE, 8.5 MILLION MACHINES: HOW CONCENTRATION SETS THE SCALE OF FAILURE

On 19 July 2024, a defective content update distributed by a single security vendor disabled an estimated 8.5 million Windows devices, a figure Microsoft placed at less than 1% of all Windows machines while observing that the broad economic and societal impacts reflected the use of CrowdStrike by enterprises that run many critical services [1]. Delta Air Lines cancelled approximately 7,000 flights over five days of disruption and later claimed more than USD 500 million in out-of-pocket losses in a complaint filed against CrowdStrike in the Superior Court of Fulton County, Georgia, on 25 October 2024 [2].

The instructive feature of the episode is the propagation rather than the defect. The update was routine, centrally distributed, and embedded beneath operations that had no tested way of running without it, so the severity of the outcome was set by the architecture of the dependency rather than by the technical seriousness of the error. An organisation's exposure to this class of failure is decided long before any incident, in choices about which providers sit beneath which operations and in whether anyone has established what the organisation can do when one of them stops.

Litigation now prices those choices. A single interrupted dependency produced a pleaded loss exceeding half a billion US dollars from one customer over five days [2]. A board that has treated vendor selection as a closed procurement outcome can read, in the Delta complaint, what the same selection looks like when it is restated as an operational loss.

II. THREE REGIMES, ONE TEST: REGULATION HAS MADE THE DEPENDENCY A GOVERNANCE OBJECT

Regulators reached the same conclusion before the outage occurred and have spent the period since building enforcement architecture around it. The EU Digital Operational Resilience Act, Regulation (EU) 2022/2554, has applied to financial entities since 17 January 2025 and frames the ultimate responsibility of the management body for managing ICT risk as an overarching principle of the regime [3]. On 18 November 2025 the European Supervisory Authorities designated the first critical ICT third-party providers for direct oversight, assessed on criteria that include a provider's systemic importance, its role in supporting critical or important functions for financial entities, and the level of substitutability of its services [4]. The first list comprises 19 providers, with cloud hyperscalers, major data vendors, and core ICT integrators featuring prominently [5].

The United Kingdom built a parallel structure. Acting under powers created by the Financial Services and Markets Act 2023, the Bank of England, the PRA, and the FCA published final rules for critical third parties in November 2024, in force from 1 January 2025 and applying to providers once HM Treasury designates them, with six Fundamental Rules and eight operational risk and resilience requirements directed principally at systemic third party services [6]. On the firm side of the same regime, in-scope financial firms had until 31 March 2025 to demonstrate that they could keep their important business services within defined impact tolerances, supported by mapping and scenario testing [7].

The pattern extends beyond financial services. The NIS2 Directive, whose transposition deadline passed on 17 October 2024, introduces accountability of top management for non-compliance with cybersecurity risk-management measures across essential sectors, an approach the European Commission describes as bringing cybersecurity to the attention of the boardroom [8][9]. In the United States, rules adopted by the SEC in July 2023 require public companies to disclose material cybersecurity incidents on Form 8-K, generally within four business days of determining materiality, and to describe board oversight of cybersecurity risk in annual reports under Regulation S-K Item 106 [10].

Read together, these regimes mark a reclassification. Third-party dependency is no longer treated as an operational hygiene matter delegated to procurement and vendor management; it is regulated as a governance object, with accountability assigned by name to management bodies and boards.

III. SUBSTITUTABILITY IS THE TEST MOST PROGRAMMES DO NOT RUN

The Financial Stability Board's December 2023 toolkit for financial institutions and financial authorities directed attention to the same point at the system level, providing tools for identifying, monitoring, and managing systemic third-party dependencies and the risks they pose to financial stability [11]. What separates a dependency register from dependency governance is the question the register cannot answer: whether the organisation could migrate to an alternative provider before breaching its own tolerance for disruption. The DORA designation criteria make that question explicit by ranking providers partly on the substitutability of their services [4].

The question is becoming harder to answer, not easier. The Bank of England's April 2025 assessment of artificial intelligence in the financial system warned that reliance on a small number of providers for a given service could generate systemic risks where rapid migration to alternatives is not feasible, and identified model costs, complexity, and vertical integration of the AI stack as factors that could increase concentration in the generative AI market over time, to the point where a widespread outage of one or several key models could leave many firms unable to deliver vital services [12]. A new and concentrated AI-supply layer is being assembled on top of cloud, data, and integration layers that the first European designation list already shows to be concentrated [5].

Supervisory expectations on the firm-side answer predate all of this. The PRA's supervisory statement on outsourcing and third party risk management, first published in March 2021, set expectations for business continuity and exit plans, including exits executed under stress [13]. The practical gap is that most exit plans exist as documents rather than as rehearsed capabilities, and the UK's March 2025 operational resilience deadline converted the document into an evidenced fact: a firm must be able to show, through mapping and testing, that its important business services stay within tolerance when the dependency fails [7].

IV. THE OVERSIGHT DUTY HAS ALREADY REACHED THE DEPENDENCY

Fiduciary doctrine arrived at the dependency from a different direction. Under Caremark, Delaware law requires boards to implement a reasonable information and reporting system for the corporation's central risks and to monitor what it reports [14]. In the Boeing derivative litigation, the Delaware Court of Chancery treated aircraft safety as a mission-critical board oversight responsibility, and the claims settled for USD 237.5 million, one of the largest derivative settlements in history [14].

The translation to technology dependency is direct. Where a single provider's failure can halt core operations for days, that dependency is mission-critical on any operational reading, and the oversight obligation attaches to it in the same way it attached to safety at an aircraft manufacturer. The disclosure architecture now makes the state of that oversight publicly legible: approximately 74% of Russell 3000 companies have codified board or committee oversight of cybersecurity following the SEC's 2023 rules [15], and Item 106 requires companies to describe how their boards exercise that oversight [10].

Codified oversight and exercised oversight are different assets. A committee charter that names third-party risk, sitting above an exit plan that has never been tested, describes accountability without exercising it. The discipline involved is the one that already applies to governing the systems an organisation deploys: an inventory of what is in use, a named owner for each item, and evidence that the stated controls operate in practice. Dependency governance extends that discipline one layer down, to the providers those systems stand on.

V. WHAT GOVERNED DEPENDENCY REQUIRES

Four elements separate governed dependency from mapped dependency. The first is an inventory ranked by substitutability rather than by spend, because the provider that costs the least may be the one the organisation can least afford to lose. The second is a set of disruption tolerances defined and owned at board level, in the manner the UK regime requires for important business services [7]. The third is exit and continuity capability tested against those tolerances, in line with supervisory expectations that contemplate stressed as well as orderly exits [13]. The fourth is explicit ownership of what remains: where a dependency is genuinely unsubstitutable, the governance output is a recorded board-level decision to accept a named concentration, with compensating controls and a defined trigger for review.

The fourth element is the least practised, because it requires the organisation to say plainly that a tolerance cannot currently be met. Regulators have already accepted that answer as legitimate; the designation criteria and concentration analyses cited above exist precisely because some services cannot be rapidly substituted [4][12]. What supervision and, increasingly, litigation will not accept is the undocumented version, in which the concentration exists, no one has costed it, and the board learns the tolerance was unmet from the incident itself.

Three developments are foreseeable on this trajectory. The published designation lists will function as de facto concentration maps of the technology economy, sharpening scrutiny of every customer of the 19 named providers [5]. Supervisory questioning will move from the existence of dependency registers to the evidence of tested exits, following the path the UK's impact-tolerance regime has already cut [7]. And within two to three years, an operational failure at a major third party is likely to generate oversight claims of the Boeing type against customer-side boards, with plaintiffs reading a company's own Item 106 disclosures back to it as the statement of the oversight it promised [10][14].

VI. CONCLUSION

Concentration is economically rational, which is why the next CrowdStrike-shaped event is a matter of timing rather than possibility. The regulatory work of 2024 and 2025 did not attempt to prohibit concentration; it assigned the resulting exposure to management bodies and boards by name, in the EU, the United Kingdom, and the United States, and it selected substitutability as the measure of whether a dependency is governed. Organisations that absorb the next event well will be those that treated each critical dependency as a governed object: ranked by substitutability, bounded by tested tolerances, and owned, where it cannot be substituted, as an explicit board-level decision. Mapping records what an organisation depends on, and governance decides what happens when the dependency stops.