Does your organization maintain a documented process for tracking and periodically updating asset priorities, especially following significant organizational changes?

Asset prioritization helps organizations allocate security resources effectively by identifying which systems and data are most critical to operations or most vulnerable to threats. Regular updates to these priorities ensure that security controls remain aligned with the organization's current risk landscape as business objectives, system architectures, or threat environments change.

Evidence could include a documented asset prioritization methodology, meeting minutes showing periodic priority reviews, change management records that trigger priority reassessments, or a current asset inventory with clearly marked priority levels and review dates.