Hmmm. I think I am slightly concerned about the way in which your company is thinking about what's on what side of the critical vs. less-than-critical line here. Because (from the way you put it) it appears that it's taking a very sort-of supposedly "traditionalist', tangible equipment-centric, location-centric approach to determining what is and is not critical in terms of risk potential. And, in my view, (yes, a slight touch of opinion leaking in here, maybe) that's a tendency you want to correct early on.
There are really two types of things* you need to protect in the critical category: critical information, and critical systems. To put it briefly but clumsily, the thing about critical information is that information doesn't just exist or move to "where it is supposed to be". There's no way you can just say "All critical information anywhere in our networks, get into our datacenter, now!" and have it work. You have to go out and find vital information/data that is hugely important and that your company absolutely must protect. You have to go out to where it's created inside your company or where it comes into your company and see where that is. You need to see whom it flows to and to where. And then see where it eventually winds up and is stored (likely that datacenter, finally.) And then, once you determine what the critical information really is and where it is and where it flows then you can start to do risk assessment and all the other fun bureaucratic planning and such.
But first you need to go out in the field and figure out where the critical info actually is. Not just say assess stuff at Location X first because Well, the important stuff is theoretically supposed to be there, and therefore it is all there. (And that's particularly not a great approach to take in this era of ubiquitous smartphone use and ever increasing cloud usage, sometimes with pre-approval from centralized management and sometimes without.)
As for critical systems, I think much of the same analysis holds. Looking after risks related to the expensive servers and networking equipment in your datacenter is certainly a good & necessary thing to do, but a reasonable person might conclude that looking at the risks relevant to the smartphones your company's R & D executives carry around everyday are even more deserving of being labeled "critical".
Anyway, my two cents. Cheers.