Does your organization maintain a comprehensive supplier inventory that includes criticality ratings for each supplier?

A supplier inventory helps organizations track all third parties that provide goods or services, while criticality ratings identify which suppliers pose the greatest risk or are most essential to operations. This enables proper allocation of resources for supplier risk management, focusing more attention on high-risk or critical suppliers. For example, a cloud hosting provider might be rated as highly critical, while an office supply vendor might receive a lower criticality rating. Evidence could include a spreadsheet or database containing a list of all suppliers with columns for criticality ratings (e.g., high/medium/low or numerical scores), assessment dates, and criteria used for determining criticality such as data access levels, operational impact, and regulatory requirements.