Abstract: A system, method, and non-transitory computer readable medium for modeling IT infrastructure risk factors. The non-transitory computer readable medium having stored instructions, which when executed by a processor may cause the processor to generate a plurality of risk matrices, where an external process of a customer of an IT supplier is mapped to an IT infrastructure element of the IT supplier and a business process of a client of the customer is mapped to the external process of the customer, perform a risk analysis using the plurality of matrices to determine a criticality value for the IT infrastructure element in relation to the business process, and cause a presentation of the criticality value.