Meridian Resilience releases a four-dimension model for quantifying hyperscaler dependency, as BC/DR practitioners report most cloud-era recovery plans have never been tested against a regional outage
BRADENTON, Fla. — Meridian Resilience LLC has released the Cloud Concentration Risk Assessment, a four-dimension framework for quantifying an organization’s exposure to correlated cloud provider failure, the risk category exposed by hyperscaler outages including the 2021 AWS us-east-1 event, the 2022 Azure Active Directory outage, and the 2024 CrowdStrike incident that took down more than 8.5 million systems simultaneously.
The framework was developed by Stuart Murray, CBCP, founder and Managing Director of Meridian Resilience, a fractional business continuity and disaster recovery advisory practice. Murray argues that cloud migration has been widely treated as a resilience upgrade, when in practice it has concentrated failure risk in a small number of providers and regions, while most disaster recovery plans have never been tested against that specific failure mode.
“Organizations assume multi-AZ redundancy, cloud-based backups, and a provider SLA add up to resilience. They don’t,” said Murray. “A provider’s uptime guarantee covers their availability, not your recovery time during their outage. Most DR plans have never been tested against a hyperscaler regional failure, and that gap doesn’t show up until the outage does.”
The framework scores organizational exposure across four dimensions:
Provider Concentration – the share of Tier 0/1 systems dependent on a single cloud provider
Regional Concentration – whether critical workloads and their backups reside in more than one region, with a tested cross-region failover path
Service Concentration – single points of failure in identity, DNS, and other shared services
DR Plan Currency – whether existing DR plans have been updated and tested against cloud-specific outage scenarios
The framework also includes a method for translating concentration risk into financial exposure; revenue at risk, regulatory exposure, customer SLA liability, and operational recovery cost, for use in board and executive risk reporting. It has direct relevance to organizations subject to the EU’s Digital Operational Resilience Act (DORA), which explicitly requires financial entities to assess and test ICT third-party concentration risk, as well as U.S. financial institutions operating under Federal Reserve and OCC guidance on cloud concentration.
Murray, a Certified Business Continuity Professional (CBCP) through DRI International and a FEMA-certified Exercise Evaluator, brings more than 25 years of Fortune 100 BC/DR leadership to the framework’s development. Prior to founding Meridian Resilience, he served as Global Head of IT Resiliency at Jabil, building the company’s global BC/DR program from initial policy to ISO 22301 certification across 34 countries, and has served as Incident Commander for more than 10 declared enterprise IT events. He has presented at more than 50 industry conferences, including Disaster Recovery Journal, Continuity Insights, and ServiceNow Knowledge.
Meridian Resilience is making the Cloud Concentration Risk Scorecard available to practitioners as a self-assessment tool, and is offering fractional DR program leadership and fixed-fee project engagements, including DR program assessments, tabletop exercise design, and ISO 22301 / NIST SP 800-34 gap analysis, for organizations that want to act on the results.
About Meridian Resilience LLC
Meridian Resilience LLC is a fractional business continuity, disaster recovery, and crisis management advisory practice founded by Stuart Murray, CBCP. The practice provides senior DR program leadership on a fractional or project basis for organizations that need enterprise-grade resilience capability without the cost, lead time, or overhead of a full-time senior hire. More information is available at meridianresilience.com.
