A supplier failure does not have to start inside your own organisation to become your incident. Tuesday's Google Cloud outage showed how quickly a third-party disruption becomes a customer-facing problem, and how quickly regulators and Parliament take an interest.
On 20 October, Google Cloud reported a power event at a third-party facility affecting its London region, europe-west2. Its Service Health dashboard records the incident beginning at 23:08 PDT on 19 October, 07:08 BST on Tuesday, with services in the europe-west2-b zone unavailable and others in the region seeing elevated errors and intermittent network issues. Google said the issue was mitigated for most customers later on Tuesday, and has committed to publishing an analysis once its internal investigation is complete.
The disruption reached well beyond Google's direct customers. The Treasury Committee described the outage as affecting a number of organisations, including banks. Revolut confirmed some of its services were disrupted as a result; Lloyds Banking Group said it expected services back to normal once the root issues were resolved. HM Courts and Tribunals Service said it was aware of an issue affecting the video platform used for remote hearings.
The same day, the Committee published a letter from its Chair, Dame Meg Hillier, to the Governor of the Bank of England and the Chief Executive of the FCA, asking how the regulators will use their powers under the Critical Third Parties regime in relation to the incident. That regime is new. In July, HM Treasury designated Microsoft Ireland Operations, Google Cloud EMEA, Amazon Web Services EMEA and Oracle Corporation UK as critical third parties, bringing the critical services they provide to the financial sector under joint oversight by the Bank of England, the PRA and the FCA.
AV Resilience interpretation
This is the first significant live test of that oversight regime, and it matters even to organisations that never deal with Google directly. Oversight of the providers does not transfer accountability: firms remain responsible for their own important business services, however far down the supply chain a failure sits.
Worth testing in your own organisation:
- Could you identify, within hours, which important business services depend on a single cloud region or zone?
- Do your supplier arrangements give you timely, usable information while a provider is still investigating?
- Have you rehearsed fallback or exit arrangements for a concentrated dependency, rather than assuming the provider's workaround is your workaround?
- Who decides what to tell customers and regulators while the supplier's own analysis is still pending?
What AV Resilience can do
AV Resilience Consulting helps firms manage exactly this exposure. Our third-party risk management work maps material suppliers and concentration risk, assesses current arrangements against the regulatory expectations that apply to you, and builds a practical operating model with roles, controls and exit plans. We can then exercise a supplier-outage scenario with your incident and communications teams, so the decisions that matter - service priorities, customer messaging, regulatory notification - are tested before a morning like Tuesday forces them for real.
Primary sources
Google Cloud Service Health incident record
