Organisations start Crown Jewels Analysis by identifying the systems, data, identities, and processes whose compromise would cause the greatest harm. Then they map dependencies, rank business impact, and test likely attack paths against those assets. The output should drive prioritised controls, monitoring, recovery plans, and executive decisions about where to concentrate protection.
What to identify before you rank anything
The first useful step in crown jewels Analysis is not a control exercise, it is a scoping exercise. Teams need to name the few assets whose compromise would create the biggest business, operational, regulatory, or trust impact, then separate them from merely important systems. That usually means including data stores, core services, privileged identities, recovery dependencies, and the processes that keep them functioning.
A practical CJA starter list should include systems that hold the most sensitive data, identities that can reach the most powerful actions, and workflows whose interruption would stop critical services. If you do not classify these elements up front, later rankings tend to overvalue visible systems and undervalue the hidden dependencies that actually determine blast radius.
How to map dependencies and attack paths
Once the crown jewels are named, the next job is to understand what they depend on and how an attacker would reach them. That means mapping upstream authentication, administration, network paths, service dependencies, data flows, and recovery tooling, then testing the most likely attack paths against those chains. The point is to see where compromise can spread, where segmentation is weak, and where a single overlooked dependency collapses the whole protection model.
This is where threat modelling becomes especially useful, because CJA needs a structured way to turn business-critical assets into realistic attack scenarios. A good starting point is NHIMG’s Threat Modelling Guide, which helps teams move from asset lists to attack trees, trust boundaries, and validated fixes.
For many organisations, the most revealing dependencies are not technical alone. They include admin access paths, shared secrets, service accounts, third-party integrations, and recovery privileges that can silently expand impact if they are left broad or long-lived.
How the output should change decisions
CJA is only useful if it produces an action ranking, not a document. The output should tell leadership where to concentrate hardening, what to monitor continuously, which recovery paths must be proven, and where business owners need to make trade-offs about resilience versus cost. If the analysis cannot distinguish between tier-one and tier-two assets, it has probably remained too abstract.
Good CJA output usually changes three decisions: which assets receive the strongest preventative controls, which paths deserve the best detections, and which scenarios need tested recovery. That makes the exercise a planning tool for security, resilience, and incident response, not just a one-time assessment.
Risk and Threat Considerations
Crown Jewels Analysis can fail if it stops at a list of valuable systems and never tests how they can actually be reached. The main risk is false confidence, where leaders assume the jewels are protected because the obvious perimeter looks strong, while privileged identities, shared services, or dependency chains still provide a direct route to them.
Failure mechanism: Attackers or insiders often do not target the crown jewel first, they target the weakest dependency around it, such as admin credentials, orchestration tooling, integrations, or recovery paths, then pivot into the higher-value asset.
Impact: A weak dependency can turn one compromise into a much larger business event, including data exposure, service disruption, recovery failure, or loss of trust in the systems the organisation considers most critical.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.AM-01 — Physical devices and systems within the organization are inventoried | CJA begins by identifying critical systems and dependencies. |
| ID.AM-02 — Software platforms and applications within the organization are inventoried | CJA must include the applications that deliver or protect crown jewels. | |
| ID.AM-03 — Organizational communication and data flows are mapped | CJA depends on dependency mapping and attack-path analysis. | |
| Recommendation — Inventory the systems and assets that support crown-jewel services before ranking impact. Map the applications that host or mediate access to crown-jewel assets. Document data flows and dependency chains to identify likely attack paths. | ||
| NIST SP 800-53 Rev 5 | RA-2 — Security Categorization | CJA is fundamentally about determining impact and criticality of assets. |
| RA-3 — Risk Assessment | CJA uses dependency and attack-path analysis to understand risk. | |
| SA-9 — External System Services | Third-party and integration dependencies can expand crown-jewel exposure. | |
| Recommendation — Categorize assets by business impact before choosing control depth. Assess likely attack paths and dependency-based risk around crown jewels. Review external services that can affect the availability or confidentiality of crown jewels. | ||
| CIS Controls v8 | CIS-1 — Enterprise Asset Inventory | CJA starts by knowing which systems and services matter most. |
| CIS-6 — Access Control Management | CJA should surface the access paths that make crown jewels reachable. | |
| CIS-12 — Network Infrastructure Management | Dependency mapping often exposes segmentation and path weaknesses. | |
| Recommendation — Maintain a current inventory of the systems that support crown-jewel services. Review and tighten the access paths that lead to crown-jewel assets. Segment and monitor the paths that connect crown jewels to the rest of the environment. | ||
Practitioner Guidance
What to prioritise: Start with a small set of high-consequence assets and make sure each one has an accountable owner, a clear dependency map, and an agreed business impact statement. If owners cannot explain why an asset is “crown jewel” material in business terms, the shortlist is too broad.
What to verify: Test whether the analysis includes privileged access, recovery dependencies, third-party connections, and the identities that can make irreversible changes. Those are the areas teams most often under-model, even when the main systems themselves are well understood.
Practitioner takeaway: The quality of CJA is measured by whether it changes priorities and exposes hidden blast-radius paths, not by how many systems it names.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 20, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org