Direct answer
Classify an asset using the business impact of disruption, data exposure and misuse, together with its dependencies and owner. Keep the criteria consistent and review the classification when the service's role changes.
Identify the business service
Map an API or server to the business process it supports. A small identity service can be critical because many applications depend on it, even if it stores little customer data. Ask the service owner about users, dependencies and recovery needs.
Reference: NIST SP 800-30 Rev. 1: Guide for Conducting Risk Assessments.
Consider distinct impacts
Separate availability, confidentiality and integrity. A public status page and a payment authorization service have different consequences if unavailable or altered. Record assumptions and the business context rather than relying only on a technical severity label.
- Name the asset and accountable owner.
- Identify sensitive data and dependent workflows.
- Record the basis and date of the classification.
Use classification in planning
Combine criticality with exposure and threat evidence when scheduling tests and fixes. An internet-facing critical service might warrant earlier assessment, while a disconnected test system may have a different priority. Do not ignore lower-rated assets that provide access to higher-value systems.
Reference: NIST SP 800-30 Rev. 1: Guide for Conducting Risk Assessments.
Review changes
Update the classification when a product gains a new integration, handles more sensitive data or changes its business role. Reconcile the inventory with owners and record uncertainty for systems whose purpose is not yet known.
Assessment limits
Criticality categories are decision aids and depend on the organization's context. They do not establish exploitability or replace a full risk assessment.
Frequently asked questions
Is a low-traffic service always low criticality?
No. It may support a critical dependency or hold sensitive data. Assess its role and impact.
Does criticality equal CVSS severity?
No. Technical severity and business impact are related but distinct inputs to prioritization.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.