performing-asset-criticality-scoring-for-vulns

Score each asset with weighted factors like data sensitivity, business function, and network exposure, then multiply the CVSS score by a tier multiplier (1.5 for Crown Jewels down to 0.5 for Minimal). The adjusted priority and per-tier SLA matrix drive remediation order.

This model uses six weighted factors: business function (25%), data sensitivity (25%), regulatory scope (15%), network exposure (15%), recoverability (10%), and user population (10%). Each factor is scored 1-5 and combined into a weighted score mapped to five tiers.

The scripts accept a CSV asset inventory with columns for hostname, data_classification, business_function, regulatory_scope, network_exposure, recoverability, and user_count. The process.py script additionally requires pandas and supports score and apply subcommands.

Each tier carries an SLA modifier: Tier 1 Crown Jewels shorten base SLAs by 50%, Tier 2 by 25%, Tier 3 keeps baseline, and Tiers 4-5 extend SLAs by 25-50%. The agent script also emits a full SLA matrix, such as 24 hours for critical findings on Tier 1 assets.

Common pitfalls include classifying all assets as critical, never updating scores when systems change roles, using only technical factors without business input, and applying uniform SLAs. Scores should be reviewed quarterly with business stakeholders and calibrated against real incident impact data.