Building resilient cloud environments from day one

Resilience is cheaper to design than to retrofit. That sentence sounds like consulting boilerplate until you have seen the invoice for the alternative — and in 2026, European regulators have started sending it.

In October 2025, an outage at a major cloud provider took down services across the internet. Among the organizations affected were retail banks whose customers simply found that their banking did not work that morning. What made the episode significant was not the outage itself — outages happen — but the regulatory reading of it. Under European rules, an institution cannot describe its cloud provider's failure as an external event beyond its control. The obligation to maintain continuity sits with the institution.

That is a meaningful shift in accountability, and it happened quietly. For a decade, moving to the cloud was implicitly understood as transferring operational risk to a party better equipped to carry it. The regulation now says something different: you may delegate the operation, but you retain the responsibility.

The Digital Operational Resilience Act has applied to European financial entities since January 2025. Through 2026 the emphasis has shifted from guidance to supervision: regulators now expect to see resilience embedded in daily operations rather than described in policy documents. It reaches well beyond banks — payment providers, insurers, asset managers, trading venues and crypto-asset service providers are all in scope, and non-EU technology suppliers are captured through the clients they serve.

In November 2025, the European supervisory authorities published a first list of nineteen designated critical ICT third-party providers, including the three hyperscale cloud platforms alongside major data, software and telecommunications suppliers. Those providers are now subject to direct oversight. For everyone else, the practical consequence is an obligation to document dependency on them and to assess the concentration risk it creates.

Two provisions deserve particular attention. One requires entities to assess concentration risk and to be able to exit a provider without undue disruption. The other requires contracts covering critical functions to contain workable exit and transition provisions. Read together, they set a standard that many organizations will find uncomfortable: a right to exit that nobody could actually execute is precisely what supervisors probe.

Most organizations can describe their primary cloud provider. Fewer can describe their real exposure, because concentration hides in the second layer. A firm may run its own workloads across two providers and consider itself diversified — while a dozen of its critical SaaS vendors all sit on the same platform, often in the same region.

This is the exposure I find most often when reviewing a cloud estate, and it is rarely deliberate. It accumulates: a payroll tool here, a treasury platform there, an identity provider, a document signature service. Each procured separately, each perfectly reasonable in isolation, and collectively a single point of failure that appears on no architecture diagram.

Designing resilience at the start is largely a matter of decisions: where state lives, how services degrade, what is stateless, how identity fails over, where backups are held. These decisions are cheap while they are still decisions. They become expensive once they are implementations with data in them.

The regulatory picture reinforces this. Deloitte research found that only around half of institutions expected to reach full compliance by the end of 2025, with a substantial share pushing their target into 2026. More striking still: in the supervisory authorities' dry-run exercise, only 6.5 percent of nearly a thousand firms passed all of the data quality checks on their register of information. The gap is not one of intent. It is that resilience documentation requires knowing things about your own estate that most organizations have never had to write down.

The three questions that reveal the truth

When I want a fast read on whether a cloud environment is genuinely resilient, I ask three things. How does this service behave when its database is unavailable — does it fail loudly, degrade gracefully, or corrupt quietly? When was a restore last performed from backup, end to end, into a working environment? And if we had to move this workload to another provider, who would do it, with what runbook, in what timeframe?

Well-architected foundations are not exotic. They are a small number of principles applied consistently, ideally before the first production workload.

If DORA does not apply to you directly, it will probably reach you indirectly. Financial entities are now contractually obliged to push resilience requirements down to their suppliers, which means any technology company serving a European bank or insurer will meet these expectations through procurement rather than regulation.

There is also a plain commercial argument. The organizations I see winning enterprise contracts are increasingly those that can answer resilience questions quickly and with evidence. Being able to produce a dependency map, a tested recovery time and a documented exit path has become a sales asset, not merely a compliance artefact.

Nobody rebuilds an estate in a quarter. But the sequence that recovers ground fastest is fairly consistent.

Cloud adoption delivered speed, elasticity and reach, and very few organizations would reverse it. What it did not do is remove operational risk; it relocated it, and for a while the relocation was invisible. Regulation has now made it visible, which is uncomfortable in the short term and useful in the long term.

The work is not glamorous. Dependency maps, restore tests, exit runbooks and a quarterly number reported to the board. But it is the difference between an organization that has an incident and one that has a crisis — and that difference is usually decided months before the bad night arrives.

About the author

Loick Moukouri

Founder, Auvantyx

Loick Moukouri is the Founder of Auvantyx. His background combines accounting and finance with cybersecurity, cloud and digital technology. He leads the firm’s vision, service offering and specialist network, helping organizations translate business priorities into practical technology, security and risk decisions.

Contact contact@auvantyx.com