US: 2023 Interagency Guidance covers the full third-party relationship lifecycle - DORA: Register of all ICT arrangements; contractual requirements; exit strategies - UK: Cloud concentration risk is a specific regulatory concern - Due diligence: financial health, SOC 2, business continuity, sub-cont