What it does. Build a multi-factor asset criticality scoring model—incorporating data Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-asset-criticality-scoring-for-vulns, or copy the skill folder into ~/.claude/skills/performing-asset-criticality-scoring-for-vulns/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-asset-criticality-scoring-for-vulns/SKILL.md

SKILL.md (verbatim)

name: performing-asset-criticality-scoring-for-vulns
description: Build a multi-factor asset criticality scoring model—incorporating data
  sensitivity, business function dependency, regulatory scope, network exposure, and
  recoverability—to produce a 1-5 criticality tier that weights vulnerability prioritization
  and remediation SLAs. Use when prioritizing vulnerability remediation by business
  impact or aligning CMDB asset data with risk-based patching timelines.
domain: cybersecurity
subdomain: vulnerability-management
tags:
- asset-criticality
- vulnerability-prioritization
- risk-management
- cmdb
- business-impact
- crown-jewels
- asset-classification
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- ID.RA-01
- ID.RA-02
- ID.IM-02
- ID.RA-06
mitre_attack:
- T1190
- T1203
- T1068

Performing Asset Criticality Scoring for Vulns

Overview

Asset criticality scoring assigns a business impact rating to each IT asset so that vulnerability remediation efforts focus on systems with the greatest organizational risk. Without criticality context, a CVSS 9.0 vulnerability on a test server receives the same urgency as the same vulnerability on a payment processing database. This skill covers building a multi-factor scoring model incorporating data sensitivity, business function dependency, regulatory scope, network exposure, and recoverability to create a 1-5 criticality tier that directly modifies vulnerability remediation SLAs.

When to Use

• When conducting security assessments that involve performing asset criticality scoring for vulns
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Prerequisites

• Configuration Management Database (CMDB) or asset inventory
• Business Impact Analysis (BIA) data
• Data classification policy
• Network architecture documentation
• Stakeholder input from business unit owners

Core Concepts

Asset Criticality Scoring Model

Criticality Tier Definitions

Data Sensitivity Scoring

Workflow

Step 1: Define Scoring Criteria

class AssetCriticalityScorer:
    """Multi-factor asset criticality scoring engine."""

    WEIGHTS = {
        "business_function": 0.25,
        "data_sensitivity": 0.25,
        "regulatory_scope": 0.15,
        "network_exposure": 0.15,
        "recoverability": 0.10,
        "user_population": 0.10,
    }

    TIER_THRESHOLDS = [
        (4.5, 1, "Crown Jewels", -0.50),
        (3.5, 2, "High Value", -0.25),
        (2.5, 3, "Standard", 0.00),
        (1.5, 4, "Low Impact", 0.25),
        (1.0, 5, "Minimal", 0.50),
    ]

    def score_asset(self, asset):
        """Calculate criticality score for an asset."""
        weighted_score = sum(
            asset.get(factor, 3) * weight
            for factor, weight in self.WEIGHTS.items()
        )
        score = round(weighted_score, 2)

        for threshold, tier, label, sla_mod in self.TIER_THRESHOLDS:
            if score >= threshold:
                return {
                    "score": score,
                    "tier": tier,
                    "label": label,
                    "sla_modifier": sla_mod,
                }
        return {"score": score, "tier": 5, "label": "Minimal", "sla_modifier": 0.50}

    def adjust_vuln_sla(self, base_sla_days, asset_tier_data):
        """Adjust vulnerability SLA based on asset criticality."""
        modifier = asset_tier_data["sla_modifier"]
        adjusted = int(base_sla_days * (1 + modifier))
        return max(1, adjusted)  # Minimum 1 day SLA

Step 2: Integrate with Vulnerability Prioritization

def apply_criticality_to_vulns(vulns_df, asset_scores):
    """Enrich vulnerability data with asset criticality context."""
    for idx, vuln in vulns_df.iterrows():
        asset_id = vuln.get("asset_id", "")
        asset_data = asset_scores.get(asset_id, {"tier": 3, "sla_modifier": 0})

        vulns_df.at[idx, "asset_tier"] = asset_data["tier"]
        vulns_df.at[idx, "asset_label"] = asset_data.get("label", "Standard")

        base_sla = get_base_sla(vuln["severity"])
        adjusted_sla = int(base_sla * (1 + asset_data["sla_modifier"]))
        vulns_df.at[idx, "adjusted_sla_days"] = max(1, adjusted_sla)

    return vulns_df

Best Practices

1. Involve business stakeholders in criticality scoring; IT alone cannot assess business impact
2. Review and update criticality scores at least quarterly or when systems change roles
3. Automate scoring where possible using CMDB tags and data classification labels
4. Apply criticality tiers to vulnerability SLAs for risk-proportional remediation
5. Validate scoring against actual incident impact data to calibrate the model
6. Start with a simple 3-tier model before expanding to 5 tiers

Common Pitfalls

• Classifying all assets as "critical" which defeats the purpose of tiering
• Not updating criticality scores when systems are repurposed or decommissioned
• Using only technical factors without business context
• Applying uniform SLAs regardless of asset importance
• Not documenting the scoring methodology for audit and consistency

Related Skills

• performing-cve-prioritization-with-kev-catalog
• building-vulnerability-aging-and-sla-tracking
• performing-business-impact-analysis
• implementing-asset-management-program

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

Asset Criticality Scoring Report Template

Scoring Summary

Tier 1 Assets (Crown Jewels)

references/api-reference.md (verbatim)

Asset Criticality Scoring for Vulnerability Prioritization — API Reference

Criticality Scoring Factors

Data Sensitivity Levels

Criticality Tiers

Risk-Adjusted Priority Formula

adjusted_priority = min(CVSS_score * tier_multiplier, 10.0)
Tier multipliers: {1: 1.5, 2: 1.3, 3: 1.0, 4: 0.8, 5: 0.5}

CSV Inventory Format

hostname,data_classification,business_function,regulatory_scope,network_exposure,recoverability,user_count
db-prod-01,pci,revenue-generating,pci-dss,dmz,manual-recovery,50000
web-staging,internal,staging,none,vpn-accessible,auto-recovery,10

Integration Points

External References

• NIST SP 800-30 Risk Assessment
• FIRST CVSS v3.1 Specification
• CISA Stakeholder-Specific Vulnerability Categorization

references/standards.md (verbatim)

Standards and References - Asset Criticality Scoring

Industry Standards

• NIST SP 800-30 Rev 1: Guide for Conducting Risk Assessments
• NIST CSF 2.0 ID.AM: Asset Management
• CIS Controls v8.1 Control 1: Inventory and Control of Enterprise Assets
• ISO 27001:2022 A.5.9: Inventory of information and other associated assets
• FAIR Framework: Factor Analysis of Information Risk

Scoring References

• NIST CMDB Best Practices
• ITIL Asset Management Framework
• CIS RAM (Risk Assessment Method)

references/workflows.md (verbatim)

Workflows - Asset Criticality Scoring

Workflow 1: Scoring Process

Identify Asset -> Gather Business Context -> Score Each Factor ->
Calculate Weighted Score -> Assign Tier -> Map to SLA Modifier ->
Store in CMDB -> Apply to Vulnerability Management

Workflow 2: Quarterly Review

Quarter Start:
    1. Export current asset criticality ratings
    2. Identify changes (new systems, decommissioned, role changes)
    3. Rescore changed assets with business owners
    4. Update CMDB with new scores
    5. Recalculate vulnerability SLAs for affected assets

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.