Criticality Analysis RA-9

Source: NIST SP 800-53 Rev.5, Risk Assessment family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

RA-9 (Criticality Analysis) is about finding the parts of a system that really matter. You examine the components, functions, and services and identify which ones the mission depends on — the pieces whose failure or compromise would hurt the most. You do this at set points in the system’s life (for example, during design and after major changes). It is a Moderate-baseline control that helps you focus protection where it counts.

What good looks like

• Identify the critical components and functions — the ones the mission cannot do without.
• Look at dependencies: what each critical function relies on to keep working.
• Do the analysis at defined decision points in the system’s life cycle, not just once.
• Use the results to prioritize protection and recovery for the parts that matter most.
• Record the critical components and the reasoning so others can see and reuse it.

Framework mapping

• NIST CSF 2.0 — ID.AM-05 — Assets are prioritized based on classification, criticality, resources, and impact on the mission

How to move it toward Implemented

• Inventory what the lab server runs and depends on (for example, systemctl list-units --type=service --state=running and the listening ports from ss -tulpn).
• Mark which services and functions are critical — the ones whose loss would stop the mission — and note what each one depends on.
• Write down the critical-component list with a sentence of rationale each, and set when you will redo the analysis (for example, after any major change).
• Attach that criticality analysis as hardening evidence on the asset, naming RA-9 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.