Critical Third Party (CTP)

Not every vendor is critical. A supplier earns the label when the firm cannot easily replace it, when its service supports an important business function, or when many firms depend on it at once, as with large cloud, payment and data providers. Firms usually rank suppliers by impact and substitutability, then apply closer due diligence, tighter contract terms, tested exit plans and more frequent monitoring to the top group. Some regulators go further and designate such providers themselves, so that they come under direct oversight. In the EU, DORA does this for key information and communication technology providers to financial entities, and the UK has created a similar regime. Concentration is a concern, since a single outage can then hit many firms together. Responsibility for the service stays with the firm even when the fault sits with the supplier, so the label drives how hard the firm tests.

A payments company uses one external provider for card processing. If that provider is offline for six hours, no customer can pay and the company breaches its service obligations. The company classes the provider as critical, requires an annual resilience test, keeps a secondary processor on standby and reviews the contract every year.