Crown Jewels Analysis (CJA) is the process of identifying the organisation’s most critical assets, data, systems and identities. It is used to focus protection on what an attacker would value most. Teams should map dependencies, classify business impact and review access paths, because incomplete analysis leaves the highest-value targets underprotected or overly exposed.
How Crown Jewels Analysis turns an abstract asset inventory into a protection priority list
CJA is not just a cataloging exercise. It asks which assets, data, systems and identities would create the greatest business damage if compromised, then ranks them by impact and exposure. The practical value is that security investment stops being evenly spread across everything and starts concentrating on the few things that would matter most in a real attack.
To do that well, teams need to go beyond ownership and naming. The analysis should capture dependencies, upstream and downstream trust paths, and the ways a crown jewel can be reached, because a highly critical asset that is easy to reach is often a more urgent problem than a less critical one with strong isolation.
What CJA has to map before it can be useful
The analysis only works when the organisation defines scope clearly. That means identifying the business services, data sets, privileged systems and identity paths that support the highest-value outcome, then tracing what depends on them and what they depend on. If the dependency map is incomplete, the result is usually a false sense of confidence: the most sensitive targets look protected on paper while their real access paths remain open.
Access paths matter because attackers rarely need every system. They need the shortest route to the most valuable one, so CJA should include authentication routes, administrative pathways, privileged access chains and any identity or session that can unlock the target. Threat Modelling Guide is a useful companion here because crown jewels analysis becomes stronger when the team explicitly models trust boundaries and likely attack paths.
Good CJA also distinguishes between criticality and sensitivity. Some assets are valuable because they are operationally essential, while others are valuable because they contain high-impact information or control capabilities. A mature analysis treats those differently, because the right control for a fragile production dependency may not be the right control for a high-value data store or a privileged administrative identity.
Why CJA changes security prioritisation instead of replacing it
CJA does not replace threat modelling, access review or architecture review. It informs them. Once crown jewels are identified, security teams can decide where stronger segmentation, tighter privilege, better logging, faster recovery objectives or more frequent review will have the greatest return. That is what makes CJA valuable: it turns broad security intent into a concrete order of operations.
The method is especially useful for deciding where not to accept weak control assumptions. If a crown jewel depends on a shared admin path, a long-lived secret, a broad service account or a hidden third-party dependency, the risk is not just the asset itself but the concentration of exposure around it. OWASP Non-Human Identities Top 10 is relevant because machine and service identities often become the route into the highest-value systems, and weak governance around those identities can defeat otherwise strong perimeter controls.
For organisations with strong detection and response maturity, CJA also helps focus monitoring. The highest-value assets should have the shortest detection latency, the most reliable audit trail and the clearest escalation path. In practice, that means the crown jewels list should drive which events get highest-fidelity logging, which accounts are most tightly governed, and which systems deserve the fastest containment playbooks.
How to keep CJA from becoming a one-time workshop artifact
CJA should be revisited whenever the business changes, not just when the security team has spare time. Mergers, platform migrations, new SaaS dependencies, privilege model changes and AI or automation rollouts can all change what is truly critical. If the analysis is not maintained, the organisation protects yesterday’s crown jewels while today’s critical paths drift out of view.
Teams should also validate the analysis against actual access telemetry and architecture reality. If the supposed crown jewel can be reached through more identities, more integrations or more environments than the diagram shows, the analysis is incomplete. If the team cannot explain who can reach the asset, through what path, and under what conditions, the crown jewel designation is not yet operationally useful.
Where the crown jewel is a highly sensitive data set or regulated environment, CJA should be integrated with the broader control framework used for governance and assurance. That helps turn the analysis into repeatable ownership, review and escalation rather than an ad hoc list that only one team understands.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.AM-01 — Physical devices and systems are inventoried | CJA depends on knowing the critical assets and systems in scope. |
| ID.AM-03 — Organizational communication and data flows are mapped | CJA needs dependency and access-path mapping to show how crown jewels are reached. | |
| PR.AA-01 — Identities and credentials for authorized users, services, and devices are managed | CJA explicitly includes identities and access paths to critical assets. | |
| Recommendation — Inventory the crown jewels and their supporting systems before prioritising controls. Map data flows and trust paths that can lead to the highest-value assets. Govern the identities that can reach crown jewels and review their access paths. | ||
| NIST SP 800-53 Rev 5 | PL-2 — System and Communications Protection Policy and Procedures | CJA supports protection planning for the most critical systems and data. |
| RA-2 — Security Categorization | CJA classifies assets by business impact to prioritise protection. | |
| AC-6 — Least Privilege | CJA should expose excessive access routes to crown jewels. | |
| Recommendation — Use crown jewels analysis to focus protection policy on the most critical assets. Categorize critical assets by impact so controls match their business importance. Reduce access to crown jewels to the minimum necessary privilege. | ||
| NIST Zero Trust (SP 800-207) | Zero Trust Architecture | CJA aligns with treating critical assets as high-value resources that need explicit verification. |
| Recommendation — Apply zero trust principles to the paths leading to crown jewels. | ||
| MITRE ATT&CK | T1078 — Valid Accounts | CJA must account for attackers using legitimate identities to reach critical assets. |
| Recommendation — Hunt for valid-account abuse on the identities that protect crown jewels. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | CJA highlights service identities that can overexpose critical systems. |
| NHI-07 — Long-Lived Secrets | CJA should expose credentials that provide persistent access to high-value assets. | |
| Recommendation — Review and reduce overprivileged non-human access to crown jewels. Rotate long-lived secrets that can reach crown jewel systems. | ||
Practitioner Guidance
What to prioritise: Start with the assets whose compromise would cause irreversible business, safety, regulatory or trust impact, then work outward to the dependencies and access paths that make them reachable. If the team begins with every important asset at once, CJA tends to flatten into a generic inventory exercise.
What to verify: Confirm that each crown jewel has a named owner, a documented dependency chain, and a tested view of who can access it, directly or indirectly. If any of those three are missing, the analysis is not yet strong enough to drive protection decisions.
Common mistake: Treating crown jewels as only the most obvious “important systems” is a frequent failure mode. The more dangerous items are often the identities, secrets, inter-system links and recovery paths that make the obvious system usable.
Practitioner takeaway: CJA is useful only when it changes prioritisation, so the real test is whether it reveals the shortest, most dangerous path to the business’s highest-value targets and forces that path to be controlled first.
Related resources from NHI Mgmt Group
- How do email detections and malware analysis work together in practice?
- What breaks when organisations do not know which systems are crown jewels?
- Who is accountable when internal validation reveals reachable crown jewels?
- How should security teams use attack path analysis to prioritise resilience work?