Criticality is a method used in many situations to identify things that are of more importance to an organisation and may require more/different treatment. Examples of where criticality is used include managing physical assets, operating chemical or process plant and transport network planning.
How does the concept of criticality apply to data?
Many people if asked to identify which data is critical to their role/team may say “All of it”, however, if there is no agreement on which data is critical, activities to improve data quality, setting backup and security policies…. can become even more challenging and expensive, as all data will need to be brought up to standard. This approach has been likened to ‘boiling the ocean’.
Considerations of criteria that can inform criticality:
- Risk and safety management, for example process information and operational safety limits
- Regulatory or legal requirements
- Financial losses related either to income or expenditure
- Essential for normal business operation, such as engineering drawings and designs of products
- Essential for operating during an incident, for example business continuity plans, emergency contact lists
- Support for essential data analysis activities, for example data used to develop corporate strategy
- Represents key entities that the organisation supports and interacts with, such as employees, customers, assets, vehicles
- Confidentiality for the organisation, its employees and anyone it interacts with, such as personal contact details, tax and payroll information, medical information
- Commercial sensitivity, for example data related to trade secrects
- Reputational impact
There is no single data criticality system which will apply to all organisations. Each organisation should determine and agree a system for determining data criticality which will be unique for that organisation.
Once your data criticality rating system is agreed, then this should be published within the organisation and used to prioritise resources and improvement activities.
If a manager raises concerns about why data they see as important is not being allocated resources, then this can be a useful test of the criticality rating system. It will also help a busy data steward defend the reasons for where current activities are focused.
Which factors do you use to assess data criticality?