Start by mapping where the workload relies on specific vendors, regions, platforms, data flows, operational teams, contracts and key management controls. Once these dependencies are visible, the conversation becomes practical: which risks are acceptable, which need mitigation, and which trade-offs the organization is willing to make.