A city CISO asks whether BAS chain coverage should prioritize crown-jewel permit and payroll systems first. What prioritization approach is sound?

A city CISO asking whether BAS chain coverage should prioritize crown-jewel permit and payroll systems first should use risk-based prioritization: chained emulation against highest-value civic assets before lower-impact workloads. Limited purple-team capacity should protect what the city cannot afford to miss detecting—permitting and payroll confidentiality, integrity, and availability. Crown-jewel-first sequencing is sound municipal risk management, not prioritizing chained emulation against offline lab copies of civic permit and payroll systems before lower-impact workloads, which lack the live controls, logging, and integrations that determine whether real attacks are detected. Prioritizing isolated validation against highest-value civic assets such as permit and payroll systems before lower-impact workloads gets the asset order right but uses the wrong method, because single-technique checks cannot validate detection of chained adversary paths across permit and payroll workflows. Prioritizing vulnerability scanning against highest-value civic assets such as permit and payroll systems before lower-impact workloads inventories known weaknesses but does not emulate adversary chains, so it cannot validate whether permit and payroll detections will catch multi-step attacks. Prioritizing chained emulation against offline lab copies of civic permit and payroll systems before lower-impact workloads tests the right chains in the wrong place, leaving detection gaps in the actual permit and payroll production and authorized-mirror controls unvalidated. Exam caveat: prioritization still requires safe methods—prefer staging mirrors or tightly gated prod checks with change control; “crown jewel first” is not a license for reckless destructive testing. Operational check: rank civic assets by business impact, schedule BAS chains against permit/payroll (or authorized mirrors) first, document residual risk for deferred lower-value subnets, and revisit priority after major city system changes.