Critical assets

Criticality is a property derived from business impact, not from technology. The classic distinction in ISO/IEC 27005 is between primary assets, the business processes and information that carry value, and supporting assets, the hardware, software, networks, people and sites those primary assets depend on. A server is critical only because something critical runs on it, which is why criticality should be inherited down a dependency graph from activities identified in a business impact analysis rather than assigned system by system. Done properly, the graph exposes assets that nobody would list as crown jewels but that everything depends on: Active Directory or the cloud identity provider, DNS, the backup platform, the hypervisor management plane, PKI and the privileged-access tooling.

Most organisations rate assets on confidentiality, integrity and availability separately and take the highest rating, then group them into a small number of tiers (for example tier 0 to tier 3) that map to concrete control baselines: recovery objectives, backup frequency, monitoring coverage, patch deadlines and change control. The distinction from data classification matters: classification labels information mainly by confidentiality and handling rules, while criticality also captures availability and integrity, so a public but safety-relevant sensor feed can be highly critical and completely unclassified.

MITRE's Crown Jewels Analysis formalises this as a mission-to-asset dependency mapping. At national level the same idea appears as critical entities and critical infrastructure: the CER Directive (EU) 2022/2557 covers the physical resilience of critical entities, and NIS2 classifies organisations as essential or important entities by sector and size. Being an essential entity under NIS2 says nothing about which of that entity's own systems are critical; that still has to be determined internally. In ISO/IEC 27001:2022 the relevant Annex A controls are 5.9 (inventory of information and other associated assets) and 5.12 (classification of information), and NIS2 Art. 21(2)(i) lists asset management among the minimum measures.

Common failure modes are a list frozen at the time of a consulting engagement, critical status inflated for political reasons until everything is tier 1, and forgetting that attackers target the administrative path to an asset rather than the asset itself. Ransomware operators routinely go for the domain controllers, hypervisors and backup consoles first, because controlling those controls every crown jewel at once; treating those systems as tier 0 is one of the highest-value outcomes of the exercise.