Has your organization established and documented criteria for determining the criticality of capabilities and services from both internal and external stakeholder perspectives?

This question assesses whether your organization has a formal methodology to identify which capabilities and services are most critical to business operations and stakeholders. Having clear criticality criteria helps prioritize security controls, resource allocation, and recovery efforts during incidents based on business impact rather than subjective assessments. An acceptable deliverable would be a documented criticality assessment framework that includes criteria such as revenue impact, regulatory requirements, customer SLAs, operational dependencies, and reputational risk. This could take the form of a criticality matrix, service catalog with criticality ratings, or business impact analysis documentation that explicitly defines how criticality is determined across the organization.