A subcontracting chain is the layered set of downstream providers that support a primary ICT service. The direct vendor may host the service, but parts of it can rely on further cloud providers, managed service firms, software suppliers, or infrastructure partners. In cyber security, this matters because control over the service becomes weaker as the chain gets longer and less visible.
Attackers look for subcontracting chains to reach a target indirectly, for example by compromising a smaller provider that has trusted access, shared updates, or remote administration paths into the main environment. Defenders use the same concept to map dependencies, review contracts, and test whether a service can be isolated or exited if one layer fails. Under resilience frameworks such as DORA, documenting the full chain helps boards and security teams spot concentration risk, hidden single points of failure, and gaps in incident response.