Fourth-Party Concentration Risk (Graphviz)

digraph fourth_party {
  rankdir=LR;
  graph [fontname="Inter", labelloc="t", label="Concentration risk - critical vendors and their subcontractors"];
  node [fontname="Inter", shape=box, style="rounded,filled", fillcolor="#eef2ff"];
  edge [fontname="Inter", fontsize=10];

  bank [label="Retail bank", shape=doubleoctagon, fillcolor="#c7d2fe"];

  subgraph cluster_third {
    label="Third parties";
    style=dashed;
    color="#94a3b8";
    fontname="Inter";
    core [label="Core banking SaaS"];
    cards [label="Card processor"];
    kyc [label="Identity verification vendor"];
    coll [label="Collections agency"];
  }

  subgraph cluster_fourth {
    label="Fourth parties";
    style=dashed;
    color="#94a3b8";
    fontname="Inter";
    cloud [label="Cloud region eu-west-1", fillcolor="#fecaca"];
    colo [label="Colocation - Slough"];
    sms [label="SMS aggregator", fillcolor="#fecaca"];
    bureau [label="Credit bureau"];
  }

  bank -> core [label="tier 1"];
  bank -> cards [label="tier 1"];
  bank -> kyc [label="tier 2"];
  bank -> coll [label="tier 3"];

  core -> cloud;
  cards -> cloud;
  kyc -> cloud;
  cards -> colo;
  kyc -> sms [label="one-time passcodes"];
  coll -> sms;
  kyc -> bureau;

  cloud -> bank [label="single point of failure behind\nthree of four tier 1-2 services", style=dotted, color="#dc2626", fontcolor="#dc2626"];
}