kidbomb

With the whole Crowdstrike fiasco, I wonder how IT analysts can properly communicate the risks of having a 3rd party service malfunction to leadership.

For example, most of us operate in the AWS space, and are aware of the risk of regional failures. While some choose to accept the risk, some instead have multi-regional deployments.

Should all these (Saas) tools be listed in a risk assessment matrix listing whether the risk can be eliminated/mitigated, or at least transferred? And if we are accepting the risk, what is the impact?