A risk framework is described for computing application risks. A risk value associated with each of one or more products included in an application may be determined. The risk value associated with each of the products may be classified as declining software risk, not-permitted software risk, declining hardware risk, and not-permitted hardware risk and may be weighted and summed to produce a technical risk score. A business criticality score may be computed based on how critical the application is to a business. The technical risk score and the business criticality score may be weighted and summed to produce a composite risk score. Based on one or more of the scores, planning may be conducted and strategies may be formulated to mitigate risk.