A dependency can be more critical than the application

The thing everybody worries about is often less important than something nobody thinks about.

The customer-facing application is visible and has an owner. The identity provider, the DNS, the certificate authority and the internal service it calls are invisible until they stop. Criticality should follow what fails when it is gone, not how prominent it is on the org chart.