All assets are formally required to be rated by their importance to business operations
Criticality tagging rates assets by business importance, a related but distinct dimension from A.5.12's sensitivity classification; the two schemes often sit side by side on the same asset register.
This policy control requires every asset to receive a business-criticality rating on a defined scale, an attribute A.5.9 expects the asset inventory to carry.
https://sekit.ai/api/mcp/crosswalk