performing-asset-criticality-scoring-for-vulns

name	performing-asset-criticality-scoring-for-vulns
description	Build a multi-factor asset criticality scoring model—incorporating data sensitivity, business function dependency, regulatory scope, network exposure, and recoverability—to produce a 1-5 criticality tier that weights vulnerability prioritization and remediation SLAs. Use when prioritizing vulnerability remediation by business impact or aligning CMDB asset data with risk-based patching timelines.
domain	cybersecurity
subdomain	vulnerability-management
tags	["asset-criticality","vulnerability-prioritization","risk-management","cmdb","business-impact","crown-jewels","asset-classification"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06"]
mitre_attack	["T1190","T1203","T1068"]

Performing Asset Criticality Scoring for Vulns

Overview

Asset criticality scoring assigns a business impact rating to each IT asset so that vulnerability remediation efforts focus on systems with the greatest organizational risk. Without criticality context, a CVSS 9.0 vulnerability on a test server receives the same urgency as the same vulnerability on a payment processing database. This skill covers building a multi-factor scoring model incorporating data sensitivity, business function dependency, regulatory scope, network exposure, and recoverability to create a 1-5 criticality tier that directly modifies vulnerability remediation SLAs.

When to Use

• When conducting security assessments that involve performing asset criticality scoring for vulns
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Prerequisites

• Configuration Management Database (CMDB) or asset inventory
• Business Impact Analysis (BIA) data
• Data classification policy
• Network architecture documentation
• Stakeholder input from business unit owners

Core Concepts

Asset Criticality Scoring Model

Factor	Weight	Score Range	Description
Business Function Impact	25%	1-5	How critical is the supported business process
Data Sensitivity	25%	1-5	Type and sensitivity of data processed/stored
Regulatory Scope	15%	1-5	Regulatory requirements (PCI, HIPAA, SOX)
Network Exposure	15%	1-5	Internet-facing vs internal-only
Recoverability	10%	1-5	RTO/RPO requirements, DR capability
User Population	10%	1-5	Number of users/customers affected

Criticality Tier Definitions

Tier	Score Range	Label	SLA Modifier	Examples
1	4.5-5.0	Crown Jewels