Every finance team models customer concentration, currency exposure, and vendor dependency. But how many have applied that same discipline to cloud infrastructure? Specifically: what would it cost the business if the cloud region hosting your critical systems were unavailable for four hours? For twelve hours?

Most companies have grown into their cloud footprint without ever making a deliberate decision about regional concentration. The question tends to surface when something external forces it: the fifteen-hour AWS US-EAST-1 outage in October 2025, or elevated geopolitical risk affecting infrastructure in the Middle East. By then, the exercise is reactive.

While regional disruptions at this scale are infrequent, the exercise tends to surface gaps in visibility and recovery planning that affect operational risk, regardless of whether a disruption ever occurs.

How Cloud Infrastructure Creates Regional Exposure

Think of cloud infrastructure like a network of commercial real estate campuses. Providers operate regions: distinct geographic clusters of data centers in specific metro areas. AWS runs regions in Northern Virginia, Ireland, São Paulo, and dozens of other locations. Google Cloud and Azure follow the same model. When your engineering team deploys systems, they choose which region those systems run in.

Within each region, providers offer availability zones (or simply "zones" in Google Cloud): isolated facilities with independent power, cooling, and networking. These function like separate buildings within the same campus. If one building loses power, the others keep running.

Here’s the distinction that matters: availability zones protect against localized failures within a region. They do not protect against disruption that affects the entire region. Whether the cause is technical or geopolitical, a region-wide event impairs all availability zones simultaneously. If your critical systems, backups, and recovery environments all reside in one region, you have concentration risk that zone-level redundancy alone does not address.

Five Questions to Frame the Assessment

These five questions are the equivalent of the stress test you'd run on any other material vendor commitment.

1. Which critical workloads, backups, and failover environments are concentrated in a single cloud region? Start with customer-facing applications, revenue systems, authentication, databases, and data pipelines. Include backup and DR environments, as well as third-party services with their own regional concentration.‍

2. Are we effectively single-region for tier-1 systems, even if we think we're resilient? Ask your engineering lead which tier-1 systems would survive a full regional outage and how long recovery would take. If the answer requires research, the zone-vs-region distinction isn't well understood for the systems that matter most.‍

3. Has failover actually been tested, or is it documented but unexercised? An untested recovery path is an assumption. If your last failover test was more than twelve months ago, or covered only a subset of dependencies, the plan may not perform as expected.

4. What would disruption cost the business at 1 hour, 4 hours, and 24 hours? This is where the conversation moves from infrastructure to finance. A credible cost estimate should account for:

5. For each tier-1 system, does the current recovery posture match the downtime cost? Once you have a cost-of-downtime estimate from question four, you can evaluate whether the current mitigation is proportionate or whether a targeted improvement would materially reduce exposure. The options scale with the stakes:

Most companies will get the majority of their risk reduction from the first two tiers. The discipline here is the same one finance applies to any capital allocation decision: match the investment to the exposure, and focus spending where the risk is concentrated.

The Right Response Is Clarity

The most valuable outcome of this exercise is usually knowing what you didn't know before: where your systems are concentrated, what disruption would cost, and whether your current resilience posture reflects a deliberate decision or something that accumulated by default.

You already model concentration risk for customers, currencies, and vendors. Cloud infrastructure is a top-three operating expense with the same concentration dynamics.