Concentration risk: how cloud is reshaping outsourcingThe Critical Third Party regime adds sector-wide oversight of cloud providers without removing firm-level responsibility for operational resilience