The Concentration Analysis page (Third-Party Risk › Concentration Analysis) surfaces the portfolio-level third-party concentration metrics that DORA Article 31 expects supervised entities to monitor. It answers the supervisor question: how exposed are you to any single ICT provider, and where is a single point of failure hiding?
Headline metrics
| Metric | What it tells you |
|---|---|
| Total providers | The number of ICT providers on the register, with the count of Critical or Important providers shown beneath. |
| Annual ICT spend | Total spend across all active contractual arrangements. This is the denominator for every share and index below. |
| HHI | The Herfindahl-Hirschman Index of spend, on a 0 to 10,000 scale. A badge flags whether the resulting concentration is low, moderate or high. The higher the number, the more your spend is concentrated in a few providers. |
| Top-5 share | The percentage of ICT spend going to your five largest providers, with the top-10 share and the number of sub-outsourced arrangements shown beneath. |
Critical-function single-provider exposure
Critical business functions served by exactly one provider are single points of failure under DORA Article 31. The page splits your critical functions into three counts:
| Count | Meaning |
|---|---|
| Single provider | Critical functions that depend on one provider only. These are the exposures a supervisor will ask about first. |
| Multi-provider | Critical functions with more than one provider, giving you a fallback. |
| Total critical | All critical functions in scope. |
Top 10 providers by spend
A ranked table lists your ten largest providers by annual spend, each with its share of total ICT spend. This is where the concentration behind the HHI and top-5 share becomes concrete: it names the providers driving your exposure.
Recalculate CTPP
The Recalculate CTPP button re-runs the concentration calculation and the critical-third-party-provider designations against the current Register of Information, so the metrics reflect the latest providers, contracts and spend. Run it after you add or re-rate providers.