We take the vendor list from your Register of Information, measure where each ICT third-party service actually runs (hosting, DNS, CDN, e-mail) and deliver a dated assessment your auditor can trace back to its evidence. Fixed price, paid by invoice.
Herfindahl-Hirschman index of your vendors per infrastructure layer, with the providers behind the shares.
Providers that carry several vendors marked critical or important, with an outage scenario for each.
Which of your vendors run on providers the ESAs designated as critical ICT third-party providers (list of 2025-11-18).
Where endpoints are served from and where the providers are headquartered: EU/EEA or third country.
Public incident history of the providers in your chain, and certificates or domains close to expiry.
Machine-readable register and evidence tables (CSV) to reconcile with your own Register of Information.
Prices in USD, excluding VAT where applicable. The operator is not VAT-registered yet.
Our accuracy figures so far come from public sources. To measure how well outside-in mapping matches a real register, we offer the Audit file at half price to three institutions that let us compare against theirs.
Before entering into a contract on ICT services supporting critical or important functions, financial entities must assess whether it leads to ICT concentration risk, including whether the provider is not easily substitutable and whether several contracts depend on the same or closely connected providers (Art. 29 of Regulation (EU) 2022/2554). Art. 28 requires a strategy for ICT third-party risk and a register of information on all contractual arrangements.
For every vendor we resolve the endpoints and determine the hosting, DNS, CDN and e-mail provider from public DNS, routing and certificate data. Per layer we compute the Herfindahl-Hirschman index (0–10,000) over vendors, and separately over vendors marked critical.
Security ratings score a vendor's own exposure. This assessment shows which shared providers your vendors depend on, so you see where one outage hits several critical functions at once.
The list of ICT third-party service providers, ideally with the ones supporting critical or important functions marked. An export of your Register of Information or a spreadsheet is enough.
The measurement itself runs in minutes. The report is ready once the scope is confirmed and the list is prepared.
We reply by e-mail with a scope confirmation and an invoice proposal. No payment is taken on this page.