ICS Crown Jewel Analysis

Focus on what matters most.

When you need it

  • Security effort is spread evenly across everything instead of concentrated where it counts
  • You need to justify where to spend first
  • You are preparing for an incident and need to know what must be protected and restored first

Some assets in an ICS environment are more critical than others. Our crown jewel analysis identifies them and prioritises their protection.

We analyse business processes, systems and data to pinpoint the most vital assets, such as production equipment, control systems and intellectual property, and assess the potential impact of a breach on safety, revenue and reputation. By evaluating dependencies, risks and vulnerabilities we create a risk management strategy aligned with your objectives and budget.

You receive a prioritised list of crown jewels with recommendations for protecting them, and we help develop a comprehensive security plan of technical and non-technical controls.

How it runs

  1. 1

    Understand the business

    The processes, systems and data, and how they depend on each other.

  2. 2

    Identify candidates

    Production equipment, control systems, intellectual property: the assets that matter most.

  3. 3

    Assess impact

    What a breach of each would mean for safety, revenue and reputation, with dependencies, risks and vulnerabilities.

  4. 4

    Prioritise

    The crown jewels, ranked, with recommendations for protecting them.

  5. 5

    Plan protection

    A security plan of technical and non-technical controls, aligned with objectives and budget.

What you get

  • A prioritised list of crown jewels
  • Impact assessed for safety, revenue and reputation
  • A risk management strategy aligned with objectives and budget
  • A security plan of technical and non-technical controls

Where it is used most

Questions we get asked

How many crown jewels will there be?

Fewer than you expect. The point of the exercise is focus.

Does this replace a risk assessment?

No, it sharpens one. Crown jewels tell the risk assessment where to look hardest.

Who needs to be involved?

Operations, engineering and the business as well as security. The impact judgements are theirs.

Talk to us about crown jewel analysis.

Tell us about the site, the systems and what you are trying to achieve. A consultant will reply.