Skip to content
ENExplore Calculators

Asset Criticality Calculator

Score an asset 0–100 for criticality from CIA requirements, user population, revenue dependency, regulation and exposure, then tier it.

About Asset Criticality Calculator

The CIA requirements carry 40 of the 100 points because they are the part of criticality that does not change when the business reorganises. User count and revenue dependency are scaled logarithmically: the difference between 100 and 1,000 dependent users is real but not tenfold, and a linear scale would let one enormous system flatten every other asset in the register. Vulnerability prioritisation is only as good as your asset tiering, and a tier assigned by a formula can be defended in a change meeting in a way that 'the app team said it was critical' cannot.

Formulas

Asset Criticality

Score = 40 × (C + I + A) ÷ 15 + min(20, 1.5 × log₂(users)) + min(20, 1.3 × log₂(revenue per hour)) + 10 if regulated (else 2) + 10 if internet-facing (else 4).

C, I, A
1–5 requirement ratings, not impact ratings
log₂
Logarithmic scaling so ten times the users is not ten times the criticality
regulated
In scope for a named regulation or audit

Prioritisation multiplier

Risk multiplier = 1 + score ÷ 50, giving 1.0 for a trivial asset and 3.0 for the most critical — feed it into vulnerability prioritisation.

Worked example

With the default values below, Asset Criticality Calculator returns Criticality Score of 91.7. Change any input above and every figure here is recalculated in your browser.

Inputs used

Confidentiality requirementone of 1 — Public information, 2 — Internal, 3 — Confidential, 4 — Restricted, 5 — Secret or regulated
5 — Secret or regulated
Integrity requirementone of 1 — Corruption is cosmetic, 2 — Recoverable from backup, 3 — Manual reconciliation needed, 4 — Financial or safety consequence, 5 — Undetectable corruption is catastrophic
4 — Financial or safety consequence
Availability requirementone of 1 — Days of downtime tolerable, 2 — One business day, 3 — Four hours, 4 — One hour, 5 — Continuous, no downtime
4 — One hour
Users or customers dependent on itaccepts 1–100,000,000 users
8,000 users
Revenue or cost impact per hour of outageaccepts 0–100,000,000 currency/hour
12,000 currency/hour
In scope for regulation or audit
Yes
Reachable from the internet
Yes

Results

Criticality Score
91.7 / 100
Asset Tier
Tier 1 — mission critical
CIA Requirement Contribution
34.7 pts of 40
Risk Multiplier for Prioritisation
2.83 ×
Suggested Critical Patch SLA
3 days
Handling Guidance
Tier 1: authenticated scanning weekly, emergency change path, tested restore

Step by step

  1. 1Values used
  2. 2Asset Criticality
  3. 3Prioritisation multiplier
  4. 4Criticality Score= 91.7 / 100
  5. 5Asset Tier= Tier 1 — mission critical
  6. 6CIA Requirement Contribution= 34.7 pts of 40
  7. 7Risk Multiplier for Prioritisation= 2.83 ×
  8. 8Suggested Critical Patch SLA= 3 days
  9. 9Handling Guidance= Tier 1: authenticated scanning weekly, emergency change path, tested restore

Assumptions and limits

  • The result is derived only from the 7 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Asset Criticality calculated?

Score = 40 × (C + I + A) ÷ 15 + min(20, 1.5 × log₂(users)) + min(20, 1.3 × log₂(revenue per hour)) + 10 if regulated (else 2) + 10 if internet-facing (else 4). The CIA requirements carry 40 of the 100 points because they are the part of criticality that does not change when the business reorganises. User count and revenue dependency are scaled logarithmically: the difference between 100 and 1,000 dependent users is real but not tenfold, and a linear scale would let one enormous system flatten every other asset in the register.

Why does Asset Criticality matter?

Vulnerability prioritisation is only as good as your asset tiering, and a tier assigned by a formula can be defended in a change meeting in a way that 'the app team said it was critical' cannot.

What values do I need to enter?

This calculator takes 7 inputs: Confidentiality requirement, Integrity requirement, Availability requirement, Users or customers dependent on it, Revenue or cost impact per hour of outage, In scope for regulation or audit, Reachable from the internet. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Requirement or impact?

Requirement. Ask how much confidentiality, integrity and availability the asset needs, not how bad a specific incident would be — that keeps the score stable across threats and reusable as the environment metric group in CVSS.

How often should tiers be reviewed?

Annually, plus on any material change: a new data flow, a new regulation, a migration to the internet edge. Stale tiering is the most common reason a critical asset gets patched on the low-priority cycle.

Related Calculators

Asset Criticality Calculator | Calcrivo