SA-14, Criticality Analysis, is withdrawn in NIST SP 800-53 Rev 5 and incorporated into RA-9. Its one enhancement, SA-14.1 Critical Components with No Viable Alternative Sourcing, shows the concern: some parts of a system have no substitute, and you should know which ones.
800-53 binds US federal systems and, through contracts, other organizations. For small and mid size companies it is a reference.
What it means in practice
A criticality analysis ranks components by how badly the business suffers if they fail or are compromised. A payment library, an identity provider and a database engine rank higher than a logging helper.
Evidence to collect
- A ranked list of systems and components with the reason for each rank.
- A note for each critical component about alternatives and exit options.
- The date of the last review.
Common gaps
A single flat inventory with no ranking. Another is a ranking done once, before three major migrations.
How to implement it
Do the work under RA-9. Start with your component inventory, score impact, and revisit when architecture changes. Dependency data helps, because a transitive library can be critical without anyone choosing it.
A small worked example
Suppose a company runs a web app, a billing service and an internal wiki. The billing service rates highest because failure stops revenue and exposes payment data. The wiki rates lowest. The ranking tells you where to spend testing time, where to demand backups and where to keep a second option ready. One page of reasoning is enough if it is dated and owned.
Quick check
Where do you document criticality now?
Under RA-9, which absorbed SA-14 in Rev 5.
