Our team is defining criticality ratings for assets across the organization. We already have business services identified, with each service rated from 1–5 for confidentiality, integrity, and availability; the highest of those three values becomes the service's overall impact rating. For individual systems and assets, I'm considering using the same high-water-mark approach, but I'm unsure whether that oversimplifies things. How do you assign criticality in a CMDB, spreadsheet, or similar inventory? Do you rate assets directly using confidentiality, integrity, and availability, or do you also score factors such as business dependency, network exposure, data sensitivity, device type, and ease of recovery?
4 Answers
Start with the services you’ve already defined. For each asset, identify which business services would be affected if it became unavailable or compromised. The asset should generally inherit the highest criticality of those dependent services. If nothing depends on it, that may indicate either a genuinely low-priority asset or a business service that hasn’t been documented yet. Keep the standards research separate from this basic dependency-mapping exercise.
Model the relationships between services, applications, virtual machines, hosts, storage, and other dependencies. A critical service should drive at least the same priority for the components it relies on. Be careful not to rate every individual host as critical when the service actually depends on a resilient pool; in that case, the relevant dependency may be the pool or the minimum capacity needed to keep the critical workload running.
A practical approach is to store separate confidentiality, integrity, and availability values in the CMDB, along with a short business-impact statement explaining the rating. The difficult part is collecting and validating the information. Once those fields are reliable, they can support dependency reports, backup priorities, disaster-recovery diagrams, and other operational processes through the CMDB’s integrations or API.
We score several characteristics, such as whether the asset is internet-facing, whether it stores sensitive information, and what kind of device it is—production server, test system, workstation, network equipment, and so on. Each factor receives a value and we calculate an overall score. That gives us more detail than assigning one rating based only on the asset category.
That’s close to what we were considering with operational dependency, exposure, recoverability, business impact, and data sensitivity. My hesitation is that several of those seem to map directly to availability, confidentiality, or integrity. I’m trying to figure out whether the extra scoring adds useful detail or just makes the process harder.