ID.AM-05 says assets are prioritized based on classification, criticality, resources, and impact on the mission. An inventory tells you what you have. Prioritization tells you what to protect first and what to fix first when time is short.
CSF is voluntary guidance. There is no CSF certification.
What good looks like
Every asset class has written criteria for its priority. The criteria are applied, so each asset in the inventory carries a tier. The tiers are reviewed on a schedule and after major business changes, such as a new product line or an acquisition.
How to implement it
- Define the criteria. Ask of each asset: what happens to revenue, customers or legal exposure if it is down for a day, or if its data leaks?
- Set three tiers with plain definitions. Tier 1: loss stops the business or exposes regulated or customer data. Tier 2: serious but recoverable. Tier 3: minor.
- Apply the tiers to the inventory, starting with systems and data stores.
- Use the tier to drive decisions: patch deadlines, backup frequency, monitoring depth, access review cadence.
- Revisit every six months and when the business changes.
Evidence to collect
- The written criteria.
- The inventory with a tier column filled in.
- A review record with date and changes made.
- An example showing a tier driving a decision, such as a shorter patch window for Tier 1.
Common gaps
- Everything is labeled critical, which means nothing is.
- The tiers exist but no process uses them.
- Business owners were never asked, so engineering guesses.
Quick check
Who decides an asset's tier?
The business owner, with security advice. Engineers know how a system works, but the owner knows what an outage costs.
Sources
- NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
