Software Technologies Inventory and Attributes

Description — The exposure arising from the technology running past, or approaching, the end of supplier support.

Benefit(s) — The most foreseeable risk in the portfolio and the most commonly realized. Expressing it as a judgment rather than a date makes it actionable.

Source — Calculated or Manual.

Examples — Critical, High, Moderate, Low, None

Notes — Calculable from end-of-support proximity, criticality tier, and dependent application count. Two technologies with the same date can carry very different risk.

Description — A composite judgment of the total risk the technology represents.

Benefit(s) — Allows portfolio-level risk comparison and prioritization across technologies that are otherwise hard to rank.

Source — Calculated.

Notes — Publish the method alongside the rating; an unexplained composite invites argument about the number rather than action on it.

Description — The exposure created when a disproportionate share of the estate depends on this technology, its supplier, or a single person.

Benefit(s) — Surfaces systemic exposure that per-technology assessment misses entirely.

Source — Derived or Manual.

Notes — Derivable from dependent application counts and supplier groupings across the portfolio.

Description — Whether the technology represents a single point of failure for the systems that depend on it.

Benefit(s) — Identifies where resilience investment would have disproportionate effect.

Source — Manual or Derived.

Notes — Assess against the technology as deployed, not as it could theoretically be deployed.

Description — What the enterprise intends to do about the recorded risk.

Benefit(s) — Converts an observation into a commitment, and makes unmitigated risks visible as a set.

Source — Manual.

Notes — A recorded risk with no mitigation and no accepted-risk decision is an open item, and should be reportable as one.