Our team is defining asset criticality across the organization. We already have business services documented, with each service rated from 1–5 for confidentiality, integrity, and availability. The highest of those three scores becomes the service's overall impact rating.
I'm considering using the same high-water-mark approach for systems and other assets, but I'm not sure whether that captures the important factors. How do you assign criticality in a CMDB, spreadsheet, or similar inventory? Do you score confidentiality, integrity, and availability directly, or also consider things like exposure, recovery difficulty, operational dependencies, data sensitivity, and device type?
4 Answers
Using confidentiality, integrity, and availability is a solid foundation, including a separate business-impact statement for each asset. Store the individual C, I, and A values in the CMDB instead of recording only one combined number. Once the data is reliable, those fields can support dependency reports, backup prioritization, disaster-recovery diagrams, and other automation through the CMDB’s integrations or API.
A practical scoring model can include internet or network exposure, whether the asset stores sensitive information, and the type of device or workload—such as a production server, test system, workstation, or network appliance. Assign each factor a value and calculate an overall score. Just document the scoring rules so the result is consistent and explainable.
Model the dependencies between services, applications, virtual machines, hosts, storage, and network components. A dependency should be at least as important as the critical workloads that rely on it. Be careful with pooled infrastructure: if workloads can migrate between hosts, the dependency may be the capacity of the entire host cluster rather than one particular server. For highly critical services, you may need to record the minimum capacity required to keep them running.
That makes sense, although it’s definitely more involved than I expected. The dependency relationships seem to be the difficult part.
Start with the business services. For each asset, identify which services would be affected if it became unavailable or failed. The asset should generally inherit the highest criticality of those dependent services. If an asset is not connected to any defined business service, it can usually be rated low—but if that feels inaccurate, it may indicate that an important service has not been documented yet.
We were considering operational dependency, exposure, recovery difficulty, business impact, and data sensitivity. I’m wondering whether those mostly map back to availability, confidentiality, and integrity, though, and whether using CIA directly would be simpler.