ID.AM-5: Resource prioritisation

Requirement

The organisation's resources shall be prioritised based on their classification, criticality, and business value.

Our Implementation

All organisational resources are prioritised based on classification, criticality, and business value. Criticality levels (Critical, High, Medium, Low) are assigned to all cloud providers and software tools in the asset inventories:

• Critical: Supabase (primary database and auth), GitHub (source control) — 2 services
• High: Vercel, Azure, AWS, Slack, Microsoft Teams, plus key operational tools — 12 services
• Medium: Edge databases, AI providers, analytics, marketing tools — 16 services
• Low: Ancillary tools (link management, SEO indexing, ad tracking) — 4 services

The data classification policy defines four sensitivity levels for information assets. Resource prioritisation drives decisions about backup strategies, monitoring depth, and security control investment.

Evidence

• Cloud Infrastructure
• Software Inventory
• Data Classification