A company's disaster recovery plan replicates critical workloads from its primary region to a second region of the same public cloud provider. During a risk review, the CISO asks what happens if the provider suffers an outage affecting its control plane across all regions. What is the most accurate assessment?

Concentration risk arises when primary and recovery capabilities share a common dependency. Two regions of one provider share that provider's global control plane, identity services, management tooling, software releases and organizational processes, so an incident affecting the provider broadly can disable both at once. For services whose business impact warrants it, the plan should include recovery that does not depend on the same provider, such as a second provider or on-premises capability, chosen according to the BIA's recovery objectives. Treating region separation as removing every shared dependency confuses physical and geographic diversity with provider diversity; regions protect against local events, not provider-wide ones. Adding a third region with the same provider multiplies locations without removing the common dependency. SLA service credits are a financial remedy that rarely approaches the business loss and do nothing to restore operations, so they cannot substitute for recovery capability. Exam caveat: multi-provider recovery is costly and complex, so it is justified for critical services by the BIA and cost-benefit analysis rather than applied everywhere. Operational check: list the provider-wide dependencies of the recovery region, including identity, DNS, key management and deployment pipelines, and test recovery with the primary provider's management plane unavailable.