Critical service dependency mapping

Begin with the customer or organizational outcome

Define the business service in clear operational language, identify the accountable owner and describe the minimum acceptable outcome during disruption. Then decompose the service into the processes and activities required to deliver it.

Avoid beginning with a technology inventory. That approach often misses manual work, supplier obligations, specialist knowledge and shared capabilities used by several services.

Map every dependency category

• People: roles, skills, decision authority, minimum staffing and alternates.
• Process: activities, handoffs, timing, volumes and manual workarounds.
• Technology: applications, databases, identity, network, devices and integrations.
• Information: records, reference data, documents, configurations and access requirements.
• Facilities: offices, plants, utilities, specialist equipment and physical access.
• Third parties: suppliers, outsourcers, cloud services, logistics and critical contracts.
• Shared services: finance, HR, legal, communications, security and service management.

Show relationships and concentration risk

Capture upstream dependencies that must be available before the service can operate and downstream services that rely on its output. Mark shared components, geographic concentration, single specialists and suppliers that support several important services.

Document whether an alternative exists, how quickly it can be activated and which assumptions have actually been tested.

Use the map as an operational tool