Episode 108 — Spotlight: Criticality Analysis (RA-9)

Criticality Analysis (RA-9) identifies the components, services, and data flows whose compromise would create disproportionate harm, enabling focused protection where failure would be most damaging. For the exam, understand that RA-9 goes beyond general risk lists by ranking elements inside the system: specific microservices, encryption key stores, identity providers, message queues, build pipelines, or supplier-provided functions that, if degraded, would cascade across the mission. The analysis informs architectural patterns like redundancy, isolation, and protective monitoring, and it guides priority for recovery planning, change approvals, and testing depth. RA-9 complements RA-2 by moving from system-level impact to component-level consequence, turning critical infrastructure into named, governed assets rather than anonymous boxes on diagrams.

Operational execution starts with dependency mapping that traces how requests, credentials, and data move through the system, including cloud-native services and shared provider platforms. Teams score components using criteria such as single points of failure, blast radius, ease of replacement, privilege concentration, and detectability of failure modes. Outputs include a ranked list of critical elements, associated safeguards, and explicit constraints—such as segregation of duties for administrators of identity or key management services. Evidence consists of analysis worksheets, updated architecture diagrams, protective control mappings, and test results for failover or break-glass procedures. Metrics track time to restore the top-tier components, percentage covered by redundancy or isolation, and the share of incidents involving critical elements over time. Pitfalls include static analyses that ignore evolving architectures, treating every component as equally critical, and failing to align RA-9 outputs with contingency planning and change control. When integrated well, RA-9 focuses scarce resources where they buy the most resilience.
Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.