Cloud Security and FCA Concentration Risk: What Financial Firms Must Do Under SS2/21

What SS2/21 Requires for Cloud Arrangements

FCA SS2/21 (and its PRA equivalent) applies to cloud services in the same way as any other material outsourcing:

• Due diligence before adoption: Assess the cloud provider's security posture, resilience, subcontractor arrangements, and regulatory cooperation
• Material arrangement registration: Cloud services that are material to the firm's operations must be listed in the outsourcing register
• Contractual requirements: Contracts with cloud providers must include audit rights, SLAs, data return provisions, and termination/exit rights — many standard cloud agreements do not include these without negotiation
• Concentration risk assessment: Firms that use the same cloud provider for multiple critical systems must assess and manage the concentration risk
• Exit planning: Documented, tested plan to migrate critical workloads to an alternative provider within the firm's impact tolerance
• Ongoing monitoring: Annual review of the cloud arrangement's performance and security posture

The Specific Security Controls FCA Expects in Cloud Environments

Beyond the governance framework, the FCA expects firms using cloud infrastructure to implement appropriate technical controls:

• Identity and access management: Cloud-native IAM with MFA — not just on-premise credentials extended to cloud
• Encryption: Data encrypted at rest and in transit in cloud environments; firm-held encryption keys for sensitive data
• Network controls: VPCs, security groups, and private endpoints — not public cloud storage buckets accessible from the internet
• Configuration management: Cloud infrastructure configured securely and monitored for drift — misconfigured storage is the most common cloud data breach cause
• Log management: Cloud audit logs centralised, retained, and monitored — AWS CloudTrail, Azure Monitor, GCP Cloud Audit Logs
• Vulnerability management: Cloud-hosted applications and services subject to the same patch management and vulnerability scanning as on-premise systems

Hadrian for Cloud Attack Surface Visibility

Financial firms that have migrated rapidly to cloud often have an incomplete picture of their external attack surface — which S3 buckets are public, which API gateways are exposed, which legacy applications were migrated without security review. Hadrian's attack surface management platform discovers your entire external cloud presence — across AWS, Azure, and Google Cloud — identifying exposed services, misconfigured storage, and vulnerable applications before attackers do. That visibility is also the foundation for your SS2/21 outsourcing register and your PS21/3 important business service mapping.

Building a Cloud Exit Plan That Satisfies the FCA

The FCA's exit planning requirement is often dismissed as theoretical — until it is not. A credible cloud exit plan must address: which workloads are hosted where; which are genuinely portable (containerised) and which are locked into proprietary services; the realistic timeline to migrate each workload; the cost and operational disruption of migration; and whether alternative hosting has been contracted or can be contracted at short notice. Exit plans that have not been partially tested (at minimum, a tabletop exercise) will not satisfy a supervisor who asks whether the plan is credible.

Frequently Asked Questions