Reporting

We are looking at assessing our inventory of "Critical" vendors to ensure the assessment is looking at the criticality to the enterprise of the bank vs criticality specific to the line of business.  Wondering how others, in banking, are qualifying internally hosted services?  For example, a contract with a third party may purchase a critical software system we manage internally.  Therefore, if the third party itself experiences a problem, the software we host may not be impacted at all.

If the software is the system of record, we still rate the vendor as critical - if something happened to them, there wouldn't necessarily be further support for the software, and eventually it would have to be replaced.