When critical national capabilities rely on a small number of private technology providers, how should governments be proactive in managing resilience, sovereign capability and systemic risk?