DORA Art. 28–29 · method and benchmark

How to measure ICT concentration risk under DORA

Short answer

ICT concentration risk is the exposure that arises when several ICT services you depend on run on the same provider, or on providers that are hard to replace. To measure it, map every ICT third-party service in your Register of Information to the infrastructure it actually runs on (hosting, CDN, DNS, country), compute the Herfindahl-Hirschman index (HHI) per layer, repeat it for the services that support critical or important functions, and mark the providers the European Supervisory Authorities designated as critical (CTPPs). An HHI above 2,500 in a layer means one or two providers carry most of your vendors.

What DORA requires

Art. 28(3): Register of Information

Financial entities keep a register of all contractual arrangements on ICT services with third-party providers, at entity, sub-consolidated and consolidated level.

Art. 29(1): concentration assessment before contracting

Before a contract on ICT services supporting critical or important functions, the entity assesses whether it leads to a provider that is not easily substitutable, or to several arrangements with the same or closely connected providers.

Art. 29(2): sub-contracting chains

Where sub-contracting is possible, the entity weighs the benefits and risks of the chain, including providers established in a third country.

Art. 28(8): exit strategies

For services supporting critical or important functions, exit strategies must be documented and tested for plausibility.

The method in five steps

List the services
Take every ICT third-party service from your Register of Information, with the ones supporting critical or important functions marked. Domains are enough for the measurement.
Map each service to its infrastructure
Resolve the service's public endpoints and record the hosting provider and region, CDN, DNS operator and serving country from DNS, routing (ASN) and certificate data. Keep the raw evidence per row.
Compute HHI per layer
For each layer, take each provider's share of your services (in percent), square it and add the squares. The result runs from near 0 (fragmented) to 10,000 (one provider carries everything).
Repeat for critical services
Concentration among the few services behind critical or important functions matters more than across the whole inventory. Compute the same index on that subset and list providers that carry two or more critical services.
Mark CTPPs, jurisdiction and evidence
Flag providers on the ESAs' list of critical ICT third-party providers (18 November 2025), note third-country exposure, and tag each row as confirmed (public source), technical indicator, or assumption.

Worked example

Ten vendors: six run on AWS, two on Microsoft Azure, two on Google Cloud. Shares 60%, 20%, 20%. HHI = 60² + 20² + 20² = 3,600 + 400 + 400 = 4,400: high. If three of the six AWS vendors support critical functions, AWS is a single point of failure for those functions, even though each vendor contract looks independent.

How to read the index

below 1,500low

1,500 – 2,500moderate

above 2,500high

Bands as in the 2010 US Horizontal Merger Guidelines, which our reports use. The 2023 Merger Guidelines call markets above 1,800 highly concentrated. DORA does not prescribe an index; HHI is one transparent way to evidence the Art. 29 assessment.

Benchmark: what we measured

221 ICT services of the kind found in a financial entity's third-party inventory (payments and fintech, identity and security, enterprise SaaS, productivity and collaboration, communication APIs), mapped 27 October 2026 to 1 November 2026. Aggregate figures; no service or institution is named.

Layer	Observable	HHI	Rating	Largest shares
Hosting provider	122 / 221	3,163	high	Amazon Web Services 54% · Google Cloud 11% · Microsoft Azure 10%
CDN	137 / 221	3,133	high	Cloudflare 47% · Amazon CloudFront 23% · Akamai 17% · Fastly 7%
DNS operator	221 / 221	1,775	moderate	AWS Route 53 37% · Cloudflare 18% · Google Cloud DNS 6% · Akamai Edge DNS 5%
Serving country	121 / 221	6,540	high	US 80% · AT 9% · DE 5%

What the numbers say

46% of the services depend on Amazon Web Services in at least one layer (hosting, CloudFront or Route 53); 67% depend on AWS or Cloudflare.
75% of the services with an observable hosting provider run on AWS, Google Cloud or Microsoft Azure, all groups on the ESAs' CTPP list.
Cloudflare carries 47% of observable CDN use but is not on the CTPP list of 18 November 2025: a concentration point outside the EU oversight framework that a vendor-by-vendor review will not show.
80% of observable endpoints are served from the United States, which matters for the third-country assessment under Art. 29(2).

Hosting is hidden behind a CDN for many services, so hosting shares describe the observable part. DNS set-ups with several operators are counted as their own combination, so the DNS index is a lower bound. Public infrastructure only: contracts and undisclosed sub-contractors are not visible from outside.

Measure your own register

Free vendor scan →

Paste up to 300 vendor domains and see the concentration per layer in minutes.

Sample report →

What the full report looks like (fictitious bank). Unlock it for your own list at $50.

Institution package →

We prepare the list from your register export, re-measure after 30 and 90 days and add the auditor annex. From 1,500 USD.

Questions

What is ICT concentration risk under DORA?

DORA defines it as an exposure to individual or multiple related critical ICT third-party service providers creating a degree of dependency on them, so that their unavailability or failure could endanger the entity's ability to deliver critical or important functions or cause other adverse effects, including large losses (Art. 3(29) of Regulation (EU) 2022/2554).

Which HHI value counts as concentrated?

Common bands are below 1,500 low, 1,500 to 2,500 moderate and above 2,500 high (2010 US Horizontal Merger Guidelines); the 2023 Merger Guidelines use 1,800 as the threshold for highly concentrated. DORA sets no numeric threshold.

Is a questionnaire to vendors enough?

Questionnaires capture what vendors declare. Concentration often sits one layer below the contract: several vendors on the same cloud, CDN or DNS operator. Outside-in measurement shows that shared layer and gives dated evidence per row; it does not replace contract data.

Do I have to measure concentration among non-critical vendors?

Art. 29 focuses on services supporting critical or important functions, but the Register of Information covers all ICT arrangements. Measuring both shows whether a provider that carries many minor vendors also carries a critical one.

How often should it be repeated?

The register is reported annually with reference date 31 December. Vendors change hosting during the year, so a re-measurement before the reference date and after major vendor changes keeps the assessment current.