Shared Industrial Platforms Don’t Share the Accountability

DORA‘s critical third-party oversight regime applies specifically to financial entities and the ICT providers designated as critical to that sector. Manufacturers are not directly in scope. The pattern it exposes, however, applies just as much to a manufacturer’s own reliance on shared industrial and cloud platforms: regulatory oversight of a vendor, wherever it exists, never transfers the manufacturer’s own accountability for that relationship.

Some manufacturers watching this development assume the underlying lesson does not apply to them because they are regulated differently. That assumption misses the point: concentration risk in a small number of critical vendors is a structural property of relying on those vendors, not a consequence of a specific regulation. A manufacturer can be entirely outside DORA’s scope and still be dangerously exposed to the same failure mode DORA was designed to manage.

Executive Summary

Manufacturers watching frameworks like DORA develop in financial services can draw a direct lesson for their own vendor risk, even without being in scope: concentration in a small number of critical vendors, and the accountability that concentration creates, does not go away because no external regulator happens to oversee that specific vendor. For IT and risk leads, the practical response is treating vendor concentration as a risk to manage continuously, not a compliance category that only applies to other sectors.

Key Takeaways

1. A vendor being subject to external oversight does not transfer a manufacturer’s own accountability for that relationship. The obligation to understand and manage the risk sits with the manufacturer regardless.
2. Manufacturers relying on a small number of critical platform vendors carry concentration risk regardless of whether any external body oversees those vendors.
3. Customers and regulators increasingly expect continuous evidence of vendor oversight, not a one-time due diligence exercise performed at contract signing.
4. A register of vendor relationships and their criticality is worth maintaining regardless of sector-specific mandates, because the underlying risk exists independent of the regulation.
5. The manufacturer’s own obligation to prove control over vendor relationships never moves, whoever else is watching.

What Critical Third-Party Designation Actually Does in Financial Services

Understanding why DORA’s mechanism exists helps clarify why the underlying lesson transfers even where the regulation does not. The designation mechanism gives regulators visibility into providers whose failure could have consequences across many financial entities at once, based on systemic impact and concentration of reliance.

Designation Is About Systemic Concentration, Not Individual Vendor Risk

A provider gets designated as critical because a large number of regulated entities depend on it in ways that could create sector-wide disruption. A manufacturer’s own exposure to a vendor, based on how heavily it actually relies on that vendor, is a separate question that no designation mechanism, in any sector, answers on its behalf.

Why Your Own Accountability Never Moves

Whether or not a regulator directly oversees a vendor, the manufacturer relying on that vendor retains full responsibility for understanding what happens if it fails. This holds regardless of which sector the manufacturer operates in.

External Oversight of a Vendor Is Not Oversight of Your Contract

Even where a vendor faces intense regulatory scrutiny in another sector entirely, that scrutiny examines the vendor’s general risk management, not any individual customer’s specific contract, exit plan, or dependency. A manufacturer cannot outsource its own due diligence to a regulator that has never reviewed its actual relationship with that vendor.

Concentration Risk Exists Independent of Regulatory Scope

A manufacturer that depends on a small number of vendors for production, engineering and communications systems carries the same structural concentration risk a financial institution carries toward its critical ICT providers, whether or not any regulation names that risk explicitly.

What Good Vendor Risk Management Looks Like, Regulated or Not

The practices that make DORA’s third-party risk regime effective for financial entities are the same practices that protect any organisation relying on a small number of critical vendors.

A Register of Vendor Relationships Is a Living Record

Maintaining an accurate account of which vendors support which production and engineering functions, and how critical each is, is worth doing regardless of sector-specific mandate, because the exercise itself is what surfaces concentration risk before it becomes a crisis.

Monitoring Has to Be Continuous, Not a One-Time Exercise

A due diligence exercise performed once at contract signing does not tell a manufacturer anything about a vendor’s current risk posture years later. Continuous monitoring, even informally, is what turns a vendor relationship from an assumption into something actually managed.

Building Vendor Risk Management Before a Regulator Asks You To

The practical response for a manufacturer is to build the same internal capability a regulated financial entity is required to build: a continuously updated view of which vendors are genuinely critical, how concentrated that reliance is, and what evidence exists of ongoing oversight, done because it protects the manufacturer, not because a regulation demands it.

How a Data Control Plane Supports Continuous Vendor Risk Evidence

Demonstrating control over vendor risk depends on being able to show, continuously, what data moves through which vendors and channels, who accessed it, and under what conditions, rather than relying on a vendor’s own assurances.

The Kiteworks Data Control Plane applies data-aware, zero-trust controls to every action across every channel, capturing a continuous, tamper-proof, unthrottled audit log that feeds directly into SIEM tooling, giving manufacturers evidence of their own vendor oversight independent of any external designation regime. Single-tenant architecture and customer-owned encryption keys further mean a manufacturer’s control over its most sensitive exchanges does not depend on any third party’s oversight status.

Manufacturers that want to see how continuous evidence supports their own vendor risk management can schedule a custom demo.