Vendor inventory and criticality: the service first, then the name

The unit of assessment is the service relationship

Record which internal service is supported, which data and access exist, how replaceable the provider is and which subcontractors are involved. This makes visible whether the same group delivers uncritical consulting and a business-critical platform at the same time.

Tiering drives the depth of assessment

Criticality should determine requirements and review cadence. A high tier can result from time criticality, data risk, privileged access, regulatory relevance, concentration or a lack of substitutability.

• supported business service and RTO
• data types, system access and permissions
• substitutability and exit duration
• concentration, regions and fourth parties