What’s the best way to assign criticality to systems and assets?
Asked by
MellowPine47
Our team is defining criticality ratings for assets across the organization. We already have business services identified, with each service rated from 1–5 for confidentiality, integrity, and availability; the highest of those three values becomes the service's overall impact rating. For individual systems and assets, I'm considering using the same high-water-mark approach, but I'm unsure whether that oversimplifies things. How do you assign criticality in a CMDB, spreadsheet, or similar inventory? Do you rate assets directly using confidentiality, integrity, and availability, or do you also score factors such as business dependency, network exposure, data sensitivity, device type, and ease of recovery?
Answers
We score several characteristics, such as whether the asset is internet-facing, whether it stores sensitive information, and what kind of device it is—production server, test system, workstation, network equipment, and so on. Each factor receives a value and we calculate an overall score. That gives us more detail than assigning one rating based only on the asset category.
Reply to this answer
A practical approach is to store separate confidentiality, integrity, and availability values in the CMDB, along with a short business-impact statement explaining the rating. The difficult part is collecting and validating the information. Once those fields are reliable, they can support dependency reports, backup priorities, disaster-recovery diagrams, and other operational processes through the CMDB’s integrations or API.
Reply to this answer
Model the relationships between services, applications, virtual machines, hosts, storage, and other dependencies. A critical service should drive at least the same priority for the components it relies on. Be careful not to rate every individual host as critical when the service actually depends on a resilient pool; in that case, the relevant dependency may be the pool or the minimum capacity needed to keep the critical workload running.
Reply to this answer
Start with the services you’ve already defined. For each asset, identify which business services would be affected if it became unavailable or compromised. The asset should generally inherit the highest criticality of those dependent services. If nothing depends on it, that may indicate either a genuinely low-priority asset or a business service that hasn’t been documented yet. Keep the standards research separate from this basic dependency-mapping exercise.
Reply to this answer
Add your answer
Answers are reviewed before publication.
MellowPine47: That’s close to what we were considering with operational dependency, exposure, recoverability, business impact, and data sensitivity. My hesitation is that several of those seem to map directly to availability, confidentiality, or integrity. I’m trying to figure out whether the extra scoring adds useful detail or just makes the process harder.