We use "you can outsource operations, but you can't outsource risk". The new DORA regulations out of the EU, regardless of its issues, at least is trying to put a legal framework around "you can't blame a third party and ditch your responsibilities".