Across Boundaries: Cloud Providers, Managed Providers, Outages and Exit

All courses / AI Operations / Module 5 / Chapter 24

Learning objectives

After the lesson the participant can:

• Assess concentration from a dependency graph, including shared services and subcontracting chains
• Explain what the provider owns and what the customer owns in an outage
• Choose between multi-zone, multi-region and a second provider by the failure class each addresses
• Draft an operational transparency and exit-test annex and plan an exit test with a quality gate

Key concepts

Concentration

A property of the dependency graph and not of the number of vendors. DORA Article 29 names non-substitutable providers, multiple arrangements with one provider and the subcontracting chain; AI adds a model served by one provider or one pool of accelerators.

Provider status as telemetry

A status page is a statement by the provider about itself and can be late, wrong for a time or down with the provider. It is one input among others, and the organisation's observer must not share the provider's failure domain.

Register of information

The register DORA Article 28(3) requires of all contractual arrangements on ICT services. To an operations team it is also a dependency map, and the change pipeline can enforce it, so that a provider not on the register cannot enter production.

Exit test

A restore test whose scenario is the loss of a provider, carrying the six parts of a recoverability claim. It finds the hidden dependencies a plan does not, and Nordvik Region's first, RST-NR-2029-001, met its time objective and failed on its quality gate.

Redundancy by failure class

Multi-zone helps with a zone or hall failure; multi-region with a regional one; neither with a provider-wide control-plane or configuration failure, where a second provider as a tested recovery target helps, at the cost of a new seam.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. A sovereign option that is the only provider of several functions has a concentration cost. How would you weigh sovereignty against concentration for one of your Tier 1 services?
2. A second provider that has never been used for recovery is listed in the continuity plan. What can be said about it under the book's rule, and what would change that?
3. Nordvik Region's exit test met the time objective and failed the quality gate. Why does the book count that as a failure, and what would you have counted?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. Which failure class does multi-region deployment within one provider not address, according to the chapter's table?

   1. A zone or hall failure, such as a cooling failure in one hall
   2. A regional failure, where the needed control plane is in another region
   3. A provider-wide control-plane or configuration failure, since a global change reaches every region
   4. No class; multi-region addresses all failures of a single provider
   Show the answer

   C. A provider-wide control-plane or configuration failure, since a global change reaches every region
   The Google Cloud and Cloudflare cases of 2025 were global changes that reached every region. For that class a second provider as a tested recovery target helps, provided it is not behind the same dependency.

2. What does the chapter say the Data Act's Chapter VI and DORA do for an exit, taken together?

   1. They guarantee that an exit works once the contract contains the required terms
   2. They give contract rights and require a tested plan, but only the exit test is evidence that the exit works
   3. They transfer responsibility for continuity to the provider during the transition period
   4. They exempt a customer from keeping a second provider if switching charges are waived
   Show the answer

   B. They give contract rights and require a tested plan, but only the exit test is evidence that the exit works
   The two regimes compose: DORA requires a tested exit plan and the Data Act supplies switching mechanics. Neither makes the exit work; the test with a date, a result and an expiry is the evidence.

3. How should a provider-side action that would disable the customer's observer or stop path be treated in the contract?

   1. Delegated at Level 3 Bounded, with a quarterly sample of the actions taken and the evidence used for each
   2. Delegated at Level 1, with the provider's agent proposing the change
   3. Left to the provider's discretion during a declared emergency
   4. Never delegated, with credential revocation held by the customer and a quarterly stop drill
   Show the answer

   D. Never delegated, with credential revocation held by the customer and a quarterly stop drill
   The table anchors this in the Level 4 prohibitions of Chapter 4: an action that disables the observation or the stop path is never delegated. The customer holds credential revocation and shows it works with a timed drill.