skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-asset-criticality-scoring-for-vulns

Score asset criticality with a weighted multi-factor model to adjust vulnerability remediation SLAs.

954|172|Updated Mar 13, 2026
Search Tags:#vulnerability management#business impact#risk scoring#vulnerability prioritization#sla management#CMDB#asset criticality
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-asset-criticality-scoring-for-vulns
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-asset-criticality-scoring-for-vulns
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/vulnerability-management/performing-asset-criticality-scoring-for-vulns
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-asset-criticality-scoring-for-vulns

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Vulnerability scanners treat every asset equally, so a critical flaw on a test server gets the same urgency as one on a payment database. This Skill builds a multi-factor asset criticality scoring model that ties business impact, data sensitivity, and regulatory scope directly to vulnerability remediation SLAs.

Core Features & Use Cases

  • Weighted Scoring Model: Combines six factors (business function, data sensitivity, regulatory scope, network exposure, recoverability, user population) into a 1-5 criticality score.
  • Tier-Based SLA Adjustment: Maps scores to five tiers from Crown Jewels to Minimal, automatically shortening or extending remediation SLAs by up to 50%.
  • Vulnerability Enrichment: Python classes enrich vulnerability dataframes with asset tier, label, and adjusted SLA days for risk-proportional prioritization.
  • Use Case: A security team with a CMDB and BIA data scores all assets quarterly, then feeds the tiers into their vulnerability management pipeline so a CVSS 9.0 on a domain controller gets a 7-day SLA while the same flaw on a lab machine gets 60 days.

Quick Start

Ask the AI to build an asset criticality scoring model using the weighted factors and apply the resulting tiers to adjust vulnerability remediation SLAs for your asset inventory.

Frequently Asked Questions about performing-asset-criticality-scoring-for-vulns

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prioritize vulnerabilities based on asset criticality?▼

Score each asset with a weighted multi-factor model covering business function, data sensitivity, and regulatory scope, then map scores to tiers. Multiply the base severity SLA by the tier's SLA modifier to get an adjusted remediation deadline per vulnerability.

What factors should an asset criticality scoring model include?▼

This model uses six weighted factors: business function impact (25%), data sensitivity (25%), regulatory scope (15%), network exposure (15%), recoverability (10%), and user population (10%). Each is scored 1-5 and combined into a weighted total.

How do asset criticality tiers change vulnerability SLAs?▼

Tier 1 Crown Jewels assets shorten the base SLA by 50%, Tier 2 by 25%, Tier 3 keeps the baseline, and Tiers 4-5 extend it by 25-50%. The adjusted SLA is computed as base_sla_days multiplied by (1 + sla_modifier), with a one-day minimum.

What inputs are needed for asset criticality scoring?▼

You need a CMDB or asset inventory, Business Impact Analysis data, a data classification policy, network architecture documentation, and input from business unit owners. Business stakeholders must supply function and impact ratings rather than IT alone.

Why does asset criticality tiering fail in practice?▼

Common failures include marking everything critical, letting scores go stale after systems are repurposed, using only technical inputs without business context, and never wiring the tier into the actual SLA calculation. Quarterly reviews and documented methodology prevent these issues.

Related Skills

Explore More Software Engineering Skills→
DCx7C5DCx7C5

asset-SKILL.md

Score asset criticality across six factors and map tiers to remediation SLAs.

Community
Advanced
UnitOneAIUnitOneAI
44

patch-prioritization

Prioritize vulnerability remediation patches using SSVC 2.1, EPSS v3, and CISA KEV.

Official
Intermediate
VulnetixVulnetix
9

exploits

Identify and summarize exploit intelligence for repository dependencies.

Official
Advanced
syncfusionsyncfusion
60

syncfusion-maui-range-selector

Configure dual-thumb numeric range selection with embedded content in MAUI applications.

Official
Advanced