There’s a new nightmare scenario in enterprise cloud computing, and it’s not an AI-driven cyberattack. It’s a vendor simply going out of business and disappearing.
That’s what happened to a PBS affiliate in St. Louis, which lost 70 years of archival material, or around 50 terabytes, after a contracted PBS storage provider, Open Source Storage, ceased operating. The data had been housed at an Iron Mountain data center in Colorado, and the affiliate, Nine PBS, ultimately sued Iron Mountain as part of its effort to preserve and recover access to the archive.
The episode, while easy to file under the familiar warning to keep redundant backups, raises a key question for chief financial officers. How many finance chiefs could retrieve their company’s critical finance data if a SaaS, cloud or managed-services vendor failed tomorrow?
After all, companies spent much of the cloud era measuring whether their vendors could stay online, but they may now need to start measuring whether they can leave those vendors at all. That changes vendor management from an uptime problem into an exit problem.
See also: Innovation Keeps Expanding Compliance for Mid-Market Firms
A Date Storage Contract Is Not a Guarantee of Data Storage Infrastructure
The PBS data dispute exposes an increasingly common feature of enterprise technology that can disappear inside a procurement spreadsheet: the vendor selling a service may not be the company controlling the infrastructure beneath it. A company can have contracts with dozens of SaaS providers that ultimately depend upon the same handful of cloud, identity, security, database and storage providers. Vendor diversification on paper can therefore conceal concentration underneath.
Nine PBS contracted with Open Source Storage. Open Source Storage, in turn, used infrastructure housed by Iron Mountain. According to reporting on the dispute, Nine PBS’s contract had been scheduled to run through March 2026, but the storage provider ceased operating and the broadcaster was unable to renew access normally.
Finance teams tend to measure supplier exposure through spend, creditworthiness and contractual commitments. Technology teams tend to measure it through uptime, cybersecurity and recovery objectives.
Neither metric fully answers the question that matters when a provider fails: Who has the ability to return the company’s data?
For CFOs, that makes fourth-party dependency, or the infrastructure sitting beneath the contracted vendor, a financial resilience issue rather than an obscure technology architecture question. In today’s uncertain operating environment, CFOs can no longer assume that data protection and data recoverability are synonymous.
See also: The 7 AI Terms Every CFO Needs to Understand
Data Backup Is Not the Same Thing as Data Recoverability
Software procurement transformed technology from something companies predominantly owned into something they rent. That shifted spending from capital budgets toward recurring operating expenses, but it also transferred control of critical corporate assets into increasingly complicated chains of counterparties.
The PYMNTS Intelligence report “Vendors and Vulnerabilities: The Cyberattack Squeeze on Mid-Market Firms” found that hackers increasingly target middle market firms. These companies depend on third-party cloud providers, software-as-a-service platforms and managed service providers, which can leave them exposed.
Most resilience programs are designed around an operational failure: a server goes down, a region becomes unavailable or a ransomware attack disrupts systems. The assumption is generally that the vendor itself still exists and is participating in the recovery.
But a more revealing number than an uptime guarantee of 99.99% is the metric of “time to exit.” If a mission-critical provider ceased operating on Friday afternoon, how many hours or days would it take the company to retrieve its information, move it somewhere else and resume business without the vendor’s help?
Instead of measuring vendor concentration solely by dollars spent, finance can measure business value stranded by vendor. A relatively inexpensive platform might hold records essential to billing, customer operations or intellectual property. Its annual contract value could be trivial while its operational replacement value is enormous.
The first phase of enterprise cloud management was about asking whether data was secure. The second was about ensuring applications remained available. The next may be about determining whether corporate assets remain portable when contractual relationships fail.
The Nine PBS archive had unusual cultural value, but the structural problem it exposed is increasingly ordinary. For CFOs, the takeaway is not merely to create another backup. It is to make sure the company can still operate when the business holding that backup is no longer there.
