SPGI · CIK 64040
What S&P Global Inc. told the SEC could break it.
S&P Global's disclosures reflect the exposures of a data-and-analytics business. Because it handles large volumes of data, it faces privacy-regulation risk — GDPR and UK GDPR fines of up to 4% of annual global revenue, and, in its Mobility business, Driver's Privacy Protection Act violations that U.S. courts can penalize at $2,500 per affected individual. It delivers its products electronically and leans on its IT environment and critical third-party services such as Amazon Web Services, so a failure or disruption there could materially impair its ability to serve customers. It also operates within sanctions and export-control limits — relating to countries such as Iran, Russia and Venezuela — that have affected and may further affect its ability to sell into those geographies and the revenue it earns there.
3 self-disclosed vulnerabilities, pulled from its own filings, each in the company’s words, with the source. This is the risk register almost nobody reads.
In its own words
What could break it.
Regulatory & policy
- data-privacy fines — GDPR up to 4% of global revenue; DPPA $2,500/individualmedium
S&P Global faces data-privacy regulatory exposure including GDPR (and UK GDPR) fines of up to 4% of annual global revenues, and Driver's Privacy Protection Act violations where U.S. courts may award liquidated damages of $2,500 per affected individual (relevant to its Mobility business).
“the U.K. GDPR) or 4% of annual global revenues. Additionally, in the case of a DPPA violation, U.S. courts may award liquidated damages of $2,500 per affected individual.”
SEC filing →As of 2026 - sanctions/export-control laws (Iran, Russia, Venezuela) limiting revenue from those geographieslow
Embargoes and sanctions laws relating to countries such as Iran, Russia and Venezuela have affected and may further affect S&P Global's ability to market or sell products into those geographies (e.g., Russia/Belarus sanctions after the Ukraine conflict), adversely impacting revenue.
“These embargoes and sanctions laws have affected, and may in the future affect, our ability to continue to market and/or sell our products and services into these geographies and in turn adversely impact our revenue from such geographies.”
Supplier concentration
- dependence on AWS cloud and electronic-delivery network systemsmedium
S&P Global delivers products electronically and relies on its IT environment and critical third-party services such as Amazon Web Services to support key product and service offerings; failures or disruptions of these systems could materially adversely affect its ability to serve customers.
“We rely on our information technology environment and certain critical databases, systems, applications and services (e.g. Amazon Web Services (“AWS”)) to support key product and service offerings.”
SEC filing →As of 2026
The hidden graph
Who it depends on, and who depends on it.
Relationships surfaced from filings, including ones disclosed by the other side, which is how the non-obvious ones come to light.
Its suppliers
Amazon Web Services (Amazon.com, Inc.)
“We rely on our information technology environment and certain critical databases, systems, applications and services (e.g. Amazon Web Services (“AWS”)) to support key product and service offerings.”
Cited →
In the MyPRIA app, this is checked against the companies you actually own.
← World Watch