The Critical Third Party regime adds sector-wide oversight of cloud providers without removing firm-level responsibility for ...