Declared provider concentration

Worked example

A procurement team can check whether apparently separate suppliers share a parent company. Keep concentration and tested substitution capacity as distinct results.

Compute provider and declared common-parent shares, fractional HHI, and a supplied provider-removal exercise.

Try it yourself

The calculator opens with the fictional example already filled in. Change one input, choose Calculate locally, and compare the result to the original values below. Use Reset fictional fixture to start over.

An unknown result means the available inputs do not support a value. Check the calculator’s Warnings tab for what is missing or uncertain.

Total declared quantity 100 provider-units
Fractional Herfindahl–Hirschman index 0.38 fraction squared (0–1)
HHI on the 10,000-point scale 3800 HHI points (0–10,000)
Declared common-parent fractional HHI 0.38 fraction squared (0–1)
Largest provider share 50 %
Quantity removed before substitution 0 provider-units

Go to the calculator Browse all calculators

Calculator

Approach (label only)Changing the label does not improve capacity, speed, error rates or confidence. Enter measured differences explicitly.

Comparison conditions and human review

Equal-resource comparison conditionsRecord budget, staffing, resources, information release dates, scenario conditions and evaluation criteria. Material differences can make options not comparable.

Evaluation period

Geography / exercise boundary

Human reviewers and roles

This evaluation depends on a real transaction

Supplied human authority gateThis declaration is not legal certification. Blocked, pending or assumed gates stop transaction-dependent evaluation.

Keep units consistent within each table. Enter zero when the amount is known to be zero. Leave optional amounts blank when they are unknown. If a required value is missing, the calculator will ask for it.

Advanced: complete input envelope and optional fields

Edit optional fields using the method dictionary. Apply validates and recalculates the entire input. Unknown values remain null.

Versioned input JSON

Import local JSON or CSV

Files stay in this browser. Maximum 1 MiB. JSON imports are recalculated. CSV supports flat observation tables, with column types taken from the displayed fixture. Empty cells become null.

Workbench JSON / input envelope

CSV target table

CSV file, matching the target table headers

Compare the arrangements

Keep physical resources and evaluation conditions equal. With identical inputs, all three approaches produce identical arithmetic. The comparison refuses material differences in declared conditions; it does not verify those declarations.

Show only differing metric rows

Privacy: comparison inputs may contain sensitive notes or operational details. Storage is off by default. Do not enter personal records or sensitive infrastructure details. Reproduction exports include supplied inputs and notes, including raw small-cell inputs suppressed from CORE-009 result tables. Suppression of displayed results does not make a reproduction export safe to publish.

Save comparison inputs on this device until I clear them

Executive brief and reproducible export

Public exercise notes

Review for personal, confidential or sensitive material before saving or sharing. No automatic submission occurs.

Read the generated brief

Method, inputs and limits

Compute provider and declared common-parent shares, fractional HHI, and a supplied provider-removal exercise. Method version 0.2.0. Translate concentration into national risk, failure probability, legal competition findings or assumed substitute availability.

CORE-013 input dictionary
Input	Unit / type	Required interpretation
providers — Provider quantities and declared parents	provider-units / json	id, label, amount, optional parentId and optional spareCapacity. Missing parent ownership is unknown; distinct IDs do not prove independence. A parent may be another provider or a shared external owner ID. Declared ownership chains are followed to their root and cycles are rejected.
substitutions — Evidenced independent substitution paths	provider-units / json	Optional observations.substitutions in allocation priority order: fromProviderId, toProviderId, capacity, verifiedIndependent, evidenceId. A counted target requires declared spareCapacity; all replacements must reference supplied independent test evidence.
removedProviderIds — Providers removed in the exercise	provider IDs / json	Use the supplied schema and declared units.

Visible mathematics / decision rules

provider share = provider quantity / total quantity

fractional HHI = sum(provider share²), on a 0–1 scale; HHI points = fractional HHI × 10,000

common-parent share = sum(quantities that share an ownership root in the supplied chain) / total quantity

counted replacement = min(unreplaced removed quantity, verified path capacity, remaining target spare capacity)

What this result cannot establish

Declared ownership chains are followed to their root. Grouped concentration uses supplied relationships only. Missing links can understate concentration by ownership.
Removal allocation follows the supplied substitution-list order and is not an optimization. Only verified independent substitution with evidence and declared spare capacity is counted.
Scenario concentration is calculated over retained quantity, so it must be read with the separately reported unretained quantity.

What would falsify the assumptions?

An independent quantity, ownership or spare-capacity audit can contradict supplied shares and substitutes.
A substitute test showing shared dependency or insufficient spare capacity invalidates counted replacement.
Identical HHI can coexist with different tested fallback performance; no causal risk inference is made.
Assumptions fail if the supplied definitions, units, period, scope or source records are wrong or incomplete.
An independent source audit or replication may contradict an input or the recorded dependency.
This method creates no resources. Physical conservation is checked in the inventory and transfer ledgers; descriptive graphs and checklists are not resource-flow models.
The same equations and review checklist can be reproduced with a spreadsheet or structured human-only process.
This is deterministic arithmetic, a descriptive comparison or a structured governance check, not a fitted causal effect or forecast. Fictional inputs remain an exercise.
Equal or worse measured errors, net review effort, disclosure burden or fallback under MAR would show no added benefit or added risk; no improvement is assumed.

Reproducible fictional fixture and independently calculated expectations

This fixture is synthetic. It does not describe a country, government, company or event.

{
  "observations": {
    "unit": "provider-units",
    "origin": "synthetic",
    "sources": [
      {
        "id": "SYN-001",
        "kind": "synthetic",
        "label": "Fictional provider quantities",
        "url": null
      }
    ],
    "providers": [
      {
        "id": "P1",
        "label": "Provider one",
        "amount": 50
      },
      {
        "id": "P2",
        "label": "Provider two",
        "amount": 30
      },
      {
        "id": "P3",
        "label": "Provider three",
        "amount": 20
      }
    ]
  },
  "parameters": {}
}

Expected checks

{
  "total": 100,
  "hhi": 0.38,
  "hhi10000": 3800,
  "largestSharePercent": 50
}

Download input fixture

Authoritative background references

NIST: Cybersecurity Framework 2.0 — Outcome taxonomy, not a calculated national risk score. Reviewed 2026-11-09. Reference, not endorsement or validation.
U.S. Department of Justice: Herfindahl–Hirschman Index — Defines the market concentration calculation. This exercise draws no legal conclusion and requires a declared quantity scope. Reviewed 2026-11-12. Reference, not endorsement or validation.

These sources inform definitions or review practices. They do not validate this implementation or endorse MAR.

Open the original Scenario Studio Examine original hypotheses Find related policy modules