What it means
OT asset criticality ranks components and functions by their contribution to safety, process control, environmental protection, quality, continuity, and recovery.
Why it matters
Priorities based only on device count, vulnerability severity, or business value can overlook single points of failure and cascading physical consequences.
Practical focus
- Identify the process function, dependencies, safe-state behavior, failure modes, redundancy, manual alternatives, and recovery needs.
- Evaluate consequence to people, environment, production, quality, equipment, compliance, and upstream or downstream services.
- Use criticality to set monitoring, access, maintenance, backup, testing, spares, recovery, and response priorities.
- Preserve this evidence: Retain the criticality method, asset and function ratings, dependency maps, consequence rationale, owner approval, and review history.
- Exercise this failure scenario: A low-cost controller receives low priority even though its failure disables a safety barrier or stops an entire production train.
Common mistakes
- Using the label OT Asset Criticality without defining scope, ownership, decision authority, and the exact data, systems, people, or process affected.
- Treating a policy, contract, diagram, dashboard, or tool demonstration as proof that OT Asset Criticality operates consistently in production.
- Closing work without retaining the evidence needed to reconstruct the decision and verify the intended control outcome.
- Testing only the normal path and never rehearsing the failure condition: A low-cost controller receives low priority even though its failure disables a safety barrier or stops an entire production train.
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: