performing-asset-criticality-scoring-for-vulns

Score each asset with a weighted model covering business function, data sensitivity, regulatory scope, network exposure, recoverability, and user population. Map scores to tiers, then adjust each vulnerability's base SLA by the tier's modifier so critical assets get faster remediation.

This model uses six weighted factors: business function impact (25%), data sensitivity (25%), regulatory scope (15%), network exposure (15%), recoverability (10%), and user population (10%). Each is scored 1-5 and combined into a weighted total.

Tier 1 Crown Jewels assets cut the base SLA by 50%, Tier 2 by 25%, Tier 3 keeps baseline, and Tiers 4-5 extend SLAs by 25-50%. The adjusted SLA is computed as base days multiplied by one plus the tier modifier, with a one-day minimum.

You need a CMDB or asset inventory, Business Impact Analysis data, a data classification policy, network architecture documentation, and input from business unit owners. Without business stakeholder input, scores reflect only technical context.

Common pitfalls include classifying everything as critical, never updating scores when systems change roles, using only technical factors without business context, and applying uniform SLAs. Start with a simple three-tier model and validate scores against real incident impact data.