asset-criticality-tiering
Skill0 starsChanged 13 days agoMITView on GitHub
Assign criticality tiers to assets and identities based on business service impact, data sensitivity, privilege (Tier 0 control-plane systems) and exposure, and propagate tiers into SIEM, vulnerability prioritization, alert severity and access controls. Use when prioritizing security work by asset importance, building asset context for SOC, or defining crown jewels.
In this repository273 other files it gives its agents.
- ad-attack-path-analysisSkill
- adcs-security-reviewSkill
- ad-privileged-access-reviewSkill
- dcsync-detectionSkill
- gpo-security-reviewSkill
- kerberos-attack-detectionSkill
- agent-tool-permission-reviewSkill
- ai-incident-responseSkill
- llm-gateway-controlsSkill
- llm-security-evaluationSkill
- mcp-server-security-reviewSkill
- model-artifact-securitySkill
- prompt-injection-reviewSkill
- rag-security-reviewSkill
- api-abuse-detectionSkill
- api-authorization-testingSkill
- api-inventorySkill
- api-schema-securitySkill
- dast-baselineSkill
- sast-triageSkill
- sca-dependency-riskSkill
- secure-code-reviewSkill
- security-requirementsSkill
- threat-modelingSkill
- asset-inventory-reconciliationSkill
- external-attack-surface-reviewSkill
- shadow-it-discoverySkill
- aws-credential-compromiseSkill
- aws-iam-reviewSkill
- aws-org-guardrailsSkill
- cloudtrail-investigationSkill
- guardduty-triageSkill
- s3-exposure-reviewSkill
- azure-activity-investigationSkill
- azure-rbac-reviewSkill
- conditional-access-reviewSkill
- entra-audit-investigationSkill
- entra-signin-investigationSkill
- backup-assuranceSkill
- critical-service-mappingSkill
- ransomware-recoverySkill
- recovery-exerciseSkill
- cloud-exposure-reviewSkill
- cloud-incident-responseSkill
- cloud-logging-baselineSkill
- cloud-posture-assessmentSkill
- audit-evidence-packageSkill
- continuous-control-monitoringSkill
- control-mappingSkill
- control-testing-samplingSkill
- container-incidentSkill
- dockerfile-hardeningSkill
- image-scanningSkill
- runtime-detection-falcoSkill
- db-audit-loggingSkill
- db-exfiltration-investigationSkill
- db-hardeningSkill
- db-privilege-reviewSkill
- data-classificationSkill
- data-discoverySkill
- The first 60 shown.
The file
Files
Asset Criticality Tiering
Tier model (example)
| Tier | Criteria | Examples |
| 0 — Control plane | Compromise gives control of most of the environment | Domain controllers, IdP (Entra Connect, AD FS, Okta admin), PKI/ADCS, PAM vault, backup servers, hypervisor management, EDR/SIEM/SOAR consoles, CI/CD with prod deploy rights, cloud org admin accounts |
| 1 — Crown jewels | Critical business services or highly sensitive data | Payment systems, core ERP, customer databases, source code for flagship products, OT supervisory systems |
| 2 — Business important | Supports operations; moderate data | Departmental apps, file servers |
| 3 — Standard | User endpoints, low-impact services | Workstations, kiosks |
Factors: business impact from critical-service-mapping, data classification (data-classification), privilege/blast radius, internet exposure, regulatory scope.
Propagate
- SIEM/SOAR: asset lookup with
tier; alert severity modifier (Tier 0 ×2). - Vulnerability management: SLA by tier × exposure (
vuln-prioritization). - Access: Tier 0 administered only from PAWs; separate admin accounts per tier.
- Monitoring: Tier 0/1 require full logging, EDR in prevention mode, file integrity monitoring.
- Change management: stricter approvals.
Maintenance
Tier stored as an attribute in CMDB/cloud tags (criticality=tier0); reviewed when services change; automatic tiering rules for known roles (all DCs = Tier 0) plus owner attestation.
Output
Asset/identity | Tier | Rationale | Owner | Data | Exposure | Controls required | Gaps
Related skills
critical-service-mapping, asset-inventory-reconciliation, ad-privileged-access-review, vuln-prioritization
References
- Microsoft enterprise access model (tiering): https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-access-model
- NIST CSF 2.0 ID.AM (Asset Management): https://www.nist.gov/cyberframework
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.