Glossary
Vendor SPOF
A vendor SPOF (single point of failure) is a third party whose unavailability is enough to halt an essential activity, because no alternative can be activated within the interruption tolerance of that activity.
Contract value does not identify a SPOF
The criterion is neither annual spend nor vendor size, but substitutability: does an alternative exist, and can it be activated before the interruption becomes unacceptable? A provider costing a few thousand euros a year is a SPOF if billing depends on it, while a major contract with two qualified alternatives is not.
Three questions qualify a third party:
| Question | Answer that signals a SPOF |
|---|---|
| Which activity stops without it? | An essential or regulated activity |
| Which alternative exists? | None, or an untested one |
| How fast can it be activated? | Slower than the interruption tolerance |
The hidden SPOF: tier-2 concentration
Two distinct vendors running on the same upstream infrastructure are not redundancy. That case belongs to fourth-party risk and only surfaces once declared dependencies are consolidated. Full method in the concentration and vendor SPOF guide.
Ready to take control of your third-party risk?
I'm a company
We'll get back to you within 24 hours