Most companies do not think about cloud risk until something stops working.
Email is down.
The customer portal cannot load.
A payment system becomes unavailable.
The file storage platform is inaccessible.
The support team cannot reach customer records.
Then everyone asks the same question: “Is this our system, or is the provider down?”
That question is becoming more important.
On 13 July 2026, the UK’s new oversight framework for major cloud service providers takes effect. Microsoft, Google, Amazon and Oracle have been designated as critical third-party suppliers to the UK financial sector. The aim is to reduce the risk of widespread disruption caused by cyberattacks or technical outages at major cloud providers.
This is a financial sector move. But the lesson applies far beyond banks.
If your company depends heavily on cloud services, then your provider is already part of your business continuity plan, whether you have documented it or not.
Why Cloud Providers Are Being Treated as Critical Suppliers
Cloud platforms used to be seen as flexible IT infrastructure.
Now they are part of national and business infrastructure.
Banks, insurers, payment companies, logistics providers, healthcare organisations, retailers, software companies and professional service firms all depend on cloud platforms for daily operations.
The risk is not that cloud is bad.
The risk is concentration.
When many companies depend on the same few providers, a disruption at one provider can affect many businesses at the same time.
The UK government said the concern is that financial firms are becoming increasingly reliant on cloud services, and disruption at a major supplier could affect multiple firms at once. The designated providers will be supervised by the Bank of England, the Prudential Regulation Authority and the Financial Conduct Authority. They will also be required to carry out resilience testing, submit self-assessments and report major incidents.
That is the important point.
Cloud providers are not being treated like ordinary vendors anymore.
They are being treated as part of operational resilience.
The Real Issue: Cloud Dependency Without a Recovery Plan
Many businesses have moved systems to the cloud.
That is not the problem.
The problem is that some companies moved to the cloud and assumed the provider would handle everything.
That assumption is dangerous.
Cloud providers are responsible for the platform.
Your business is still responsible for how the service is used, protected, backed up and recovered.
This is where many continuity gaps appear.
A company may know which cloud platform it uses, but not:
- Which systems depend on it
- Which departments are affected if it goes down
- Whether data is backed up outside the platform
- Whether admin access is protected
- Whether the provider has a recovery SLA that matches the business need
- Whether there is a manual workaround
- Whether the company can migrate if needed
- Whether vendor risk has ever been reviewed
That is not a cloud strategy.
That is dependency without visibility.
What Cloud Concentration Risk Looks Like in Real Life
Cloud concentration risk sounds like a boardroom term.
In practice, it is simple.
It means too much of your business depends on one provider, one platform, one region, one account or one integration.
Here are common examples.
One Provider Runs Everything
Your email, file storage, identity, virtual machines, backup, collaboration tools and customer systems all sit under one cloud provider.
This is convenient.
But if the account is compromised or the provider has a major disruption, the impact is broad.
One Region Hosts Critical Systems
Your application runs in one cloud region only.
There is no secondary region, no tested failover and no clear recovery sequence.
If the region has a problem, the business waits.
One Admin Account Controls Too Much
A single cloud admin account has access to billing, infrastructure, backup, user accounts and security settings.
If that account is compromised, the attacker can do serious damage.
Backup Is Stored in the Same Environment
The company has backup, but it sits inside the same platform and under the same access structure.
If the main account is affected, the backup may also be at risk.
No Exit Plan Exists
The company depends on one SaaS or cloud provider, but has no practical plan to move data out if pricing, availability, compliance or service quality becomes a problem.
This is common.
It is also risky.
Why This Matters Even Outside the Financial Sector
The UK regulation is aimed at financial firms.
But every business should pay attention.
A cloud outage does not only affect banks.
It can affect:
- E-commerce checkout
- Customer support systems
- Company email
- Accounting platforms
- HR systems
- ERP applications
- CRM platforms
- Remote work access
- File sharing
- Backup dashboards
- Website hosting
- API integrations
- Payment workflows
For many companies, cloud downtime now means business downtime.
The impact is no longer limited to the IT department.
Sales cannot access customer records.
Finance cannot issue invoices.
Support cannot respond to tickets.
Management cannot see reports.
Operations cannot process orders.
Customers cannot complete transactions.
This is why cloud resilience belongs in the business continuity plan, not only in the IT checklist.
What Businesses Should Review Now
You do not need to be a bank to manage cloud provider risk properly.
Start with a practical review.
1. List Your Critical Cloud Services
Do not begin with vendor names.
Begin with business functions.
Ask which cloud services support:
- Email and communication
- Customer service
- Finance and billing
- Website and online sales
- File storage
- User identity and login
- Internal applications
- Backup and disaster recovery
- Remote access
- Security monitoring
Once the list is clear, map each function to the provider behind it.
This shows where dependency is concentrated.
2. Identify Your Single Points of Failure
A single point of failure is anything that can disrupt the business if it fails alone.
This may be a cloud region, internet line, firewall, admin account, database, SaaS tool, DNS provider or backup platform.
The goal is not to remove every single point immediately.
That may be too expensive.
The goal is to know which ones matter most.
3. Review Backup Location and Access
Backup should not be treated as a tick-box item.
Ask these questions:
- Is backup stored separately from the production system?
- Can backup be deleted by the same admin account?
- Is immutable backup available?
- Is recovery tested?
- How long does restore take?
- Does backup cover all critical systems or only selected files?
- Is there documentation for recovery?
A backup that cannot be restored quickly is not a recovery plan.
It is storage.
4. Match Recovery Time to Business Impact
Not every system needs the same recovery speed.
Your public website, accounting system, customer portal and internal archive do not carry the same urgency.
Classify systems by impact.
For each one, define:
- How long the business can operate without it
- How much data loss is acceptable
- Who owns the recovery decision
- What workaround exists while recovery is happening
This is where RTO and RPO become useful.
RTO is how fast you need to recover.
RPO is how much data you can afford to lose.
Without these two numbers, cloud recovery planning becomes guesswork.
5. Check Cloud Access Control
Cloud outages are not the only risk.
Account compromise can be just as damaging.
Review:
- Who has admin access
- Whether MFA is enabled
- Whether old users are removed
- Whether vendor accounts are still active
- Whether privileged access is logged
- Whether shared accounts are used
- Whether backup access is separated
If one compromised account can delete systems and backup, the design needs improvement.
6. Read the Provider SLA Properly
Many businesses quote the cloud provider’s uptime percentage but never read the details.
An SLA may not mean what management thinks it means.
Check:
- What service is covered
- What is excluded
- What compensation is offered
- Whether support response is included
- Whether data recovery is included
- Whether regional outages are handled differently
- Whether the SLA matches your business requirement
Cloud provider SLA and business recovery requirement are not the same thing.
7. Prepare an Exit or Portability Plan
This does not mean changing provider immediately.
It means knowing what would happen if you had to.
Ask:
- Can we export our data?
- In what format?
- How long would it take?
- Do we have a secondary provider option?
- Are our systems portable?
- Are we locked into proprietary services?
- What would migration cost?
- Who would manage the migration?
Most companies do not need active multi-cloud for every system.
But they should not be trapped without a plan.
Cloud Resilience Is Not the Same as Multi-Cloud
Some businesses hear “cloud risk” and immediately think they need multi-cloud.
Not always.
Multi-cloud can improve resilience when designed properly.
It can also increase cost, complexity and security risk when done badly.
For many companies, the better first step is not full multi-cloud.
It is better cloud governance.
That means:
- Clear system inventory
- Proper backup
- Tested recovery
- Strong access control
- Vendor risk review
- Monitoring
- Incident response
- Documented recovery procedures
After that, the company can decide whether multi-region, hybrid cloud or multi-cloud makes sense.
Do not buy complexity before fixing the basics.
The Management Question: What Happens If This Provider Goes Down?
Every company that depends on cloud should ask one practical question:
What happens if this provider is unavailable for one full business day?
Not one minute.
Not one hour.
One full business day.
If the answer is unclear, the business continuity plan is incomplete.
You should know:
- Which systems stop
- Which teams are affected
- Which customers are affected
- Which manual workarounds exist
- Which data is still accessible
- Which vendors must be contacted
- Which recovery steps happen first
- Who approves emergency decisions
- How customers will be updated
This exercise is simple.
It often reveals uncomfortable gaps.
That is exactly why it is useful.
When to Review Your Cloud Provider Risk
Cloud risk should not be reviewed only during annual renewal.
It should be reviewed when something changes.
A review is especially important when:
- You move a core system to cloud
- You adopt a new SaaS platform
- You centralise identity or email
- You introduce remote access
- You change backup provider
- You connect systems through API
- You onboard a new managed service provider
- You enter a regulated customer supply chain
- You experience a near-miss outage or cyber incident
- You expand to more branches or countries
These are the moments when dependency changes.
If the risk review does not happen at the same time, the company may not notice the new exposure.
What a Proper Cloud Resilience Review Should Include
A credible cloud resilience review should not be a generic checklist.
It should produce useful business outputs.
At minimum, it should include:
- Inventory of critical cloud services
- Dependency map by business function
- Single point of failure analysis
- Backup and recovery review
- Access control review
- Provider SLA review
- Incident response workflow
- Recovery priority list
- Risk rating by business impact
- Practical remediation roadmap
The output should be understandable by management, not only technical staff.
If the report cannot explain business impact clearly, it will not drive action.
The Bigger Lesson from the UK Move
The UK’s decision to regulate major cloud providers shows one thing clearly.
Cloud is now critical infrastructure.
Not just for banks.
Not just for large enterprises.
For any company that depends on digital operations.
This does not mean cloud should be avoided.
Cloud remains one of the most practical ways to scale, modernise and secure business systems.
But cloud must be managed properly.
The provider’s resilience helps.
Your own planning still matters.
Closing Thoughts
Cloud services make modern business easier.
They also create dependency.
The UK’s new oversight of major cloud providers is a reminder that cloud risk is now serious enough to be treated at regulatory level. Microsoft, Google, Amazon and Oracle are now directly supervised as critical third-party suppliers for the UK financial sector, with requirements around resilience testing, self-assessment and major incident reporting.
For businesses, the message is straightforward.
Do not wait for an outage to discover how dependent you are.
Review your cloud services.
Protect access.
Separate backup.
Test recovery.
Understand provider SLAs.
Prepare an incident response plan.
Document who does what when cloud services fail.
Cloud resilience is not about assuming nothing will go wrong.
It is about making sure the business can continue when something does.
If your company wants to review cloud dependency, backup readiness or disaster recovery planning, Net Onboard can help assess your current setup and design a practical continuity plan that matches your business requirements.