Asset Criticality Calculator

Score = 40 × (C + I + A) ÷ 15 + min(20, 1.5 × log₂(users)) + min(20, 1.3 × log₂(revenue per hour)) + 10 if regulated (else 2) + 10 if internet-facing (else 4). The CIA requirements carry 40 of the 100 points because they are the part of criticality that does not change when the business reorganises. User count and revenue dependency are scaled logarithmically: the difference between 100 and 1,000 dependent users is real but not tenfold, and a linear scale would let one enormous system flatten every other asset in the register.

Vulnerability prioritisation is only as good as your asset tiering, and a tier assigned by a formula can be defended in a change meeting in a way that 'the app team said it was critical' cannot.

This calculator takes 7 inputs: Confidentiality requirement, Integrity requirement, Availability requirement, Users or customers dependent on it, Revenue or cost impact per hour of outage, In scope for regulation or audit, Reachable from the internet. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Requirement. Ask how much confidentiality, integrity and availability the asset needs, not how bad a specific incident would be — that keeps the score stable across threats and reusable as the environment metric group in CVSS.

Annually, plus on any material change: a new data flow, a new regulation, a migration to the internet edge. Stale tiering is the most common reason a critical asset gets patched on the low-priority cycle.