A useful approach is: 1. inventory processes, data and dependencies; 2. determine the desired level of sovereignty per system; 3. improve purchasing, contracts, architecture, knowledge and alternatives; 4. Periodically check whether the measures are still working and make adjustments.
Treat this as a cycle. Suppliers, ownership, legislation and technology change. A one-off assessment therefore quickly becomes outdated.