Crown Jewel Analysis: Deciding What to Protect First

Every organization has more important systems than it can protect equally. Crown jewel analysis is the discipline of deciding, with evidence and before an incident, which few assets and processes the business cannot lose, and then putting the strongest protection, monitoring and recovery effort there. Most attempts fail in the first step: they ask the wrong people the wrong question.

Start with the business outcome, not the asset list

A common mistake is to rank systems by data volume or by who shouts loudest. A better question is: if this stopped, was altered or leaked, what could the organization no longer do, and how fast would that matter? The answer defines a crown jewel by its consequence.

Regulators use the same logic. CBUAE regulation C 1/2026 (Rulebook header: effective 14 September 2026) defines Critical Operations as an institution’s Critical Functions plus all activities, processes, services and supporting assets whose disruption would impact its continued operation, its role in the financial system or its customers. It defines Critical Information Assets as data assets whose confidentiality, integrity or availability is critical to Critical Operations or to legal and regulatory compliance. Article 3.4 requires a mapping, for each Critical Operation, of the people, technology, processes, data, facilities and third-party providers needed to deliver it, plus their interdependencies, updated through change management.

The NIST CSF 2.0 says the same in framework terms. GV.OC-04 asks that critical objectives, capabilities and services that stakeholders depend on are understood. ID.AM-05 asks that assets are prioritized by classification, criticality, resources and impact on the mission.

A five-step method

1. List the outcomes the business cannot lose. Interview executives about revenue, obligations and trust. Limit the list to what is truly critical, usually no more than a handful.

2. Map each outcome to what delivers it: applications, data, infrastructure, identities, suppliers and people. This is the dependency map CBUAE Article 3.4 describes.

3. Mark the pieces that would cause failure on their own. These are the crown jewels. Include their supporting services, such as identity systems and backup, because attackers reach jewels through them.

4. Trace the paths in. Ask how an attacker, an insider or a supplier could reach each jewel, and which controls sit on each path.

5. Set protection, detection and recovery targets for each jewel and assign an owner. Review when the business or the architecture changes.

What a good register records

Three public cases

Common failures

• Treating the largest data store as the crown jewel while the identity system that unlocks everything is unlisted.

• Leaving suppliers off the map. Critical Operations depend on third parties; CBUAE Article 13.9.4 requires management of dependencies on them for Critical Operations.

• Building the list once. The register must change when systems, suppliers or strategy change.

• Producing a report and no action. Each jewel needs a protection and recovery target and a test.

Decision

Decision: limit the first register to the three to five outcomes that would hurt most. Map and test those before widening scope. A short list that is tested beats a long list that is not.

What this evidence does not show

The Maersk figures are the company’s own estimate in its interim report. We did not verify separate accounts of the incident, and we do not use any claim about its network design. The method is Cybrilliant analysis informed by the cited frameworks; no standard prescribes these five steps.

A short test

Ask five executives to name the three systems the business cannot lose. If their lists differ, you do not yet have a crown jewel list.

Sources

1. Central Bank of the UAE, Operational Risk Management Regulation C 1/2026, Rulebook. Accessed 9 October 2026. rulebook.centralbank.ae/en/rulebook/operational-risk-management-regulation

2. NIST Cybersecurity Framework 2.0 (CSWP 29), 26 February 2024. Accessed 9 October 2026. nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf

3. A.P. Moller-Maersk, Interim Report Q2 2017. Accessed 9 October 2026. investor.maersk.com/static-files/c95cbb9d-bc4d-4394-9664-67d5ba39e4e9

4. US House Committee on Oversight and Government Reform, Majority Staff Report, The Equifax Data Breach, December 2018. Accessed 9 October 2026. oversight.house.gov/wp-content/uploads/2018/12/Equifax-Report.pdf

5. US Senate Commerce Committee, Majority Staff Report, A Kill Chain Analysis of the 2013 Target Data Breach, 26 March 2014. Accessed 9 October 2026. commerce.senate.gov/wp-content/uploads/media/doc/2014%200325%20Target%20Kill%20Chain%20Analysis.pdf