An information security manager must decide which systems deserve the strongest protection, but the IT inventory lists hundreds of applications with no indication of business importance. The enterprise architecture repository maps business capabilities to the processes and applications that support them. Which approach BEST determines system criticality?

Criticality is a business property, not a technical one. An enterprise architecture repository that links business capabilities to processes, applications and infrastructure lets the security manager start from what the organization must be able to do and follow those dependencies down to the technology. Systems that support critical capabilities inherit that criticality, including shared infrastructure that no single business unit thinks of as its own. That traceability then drives classification, control strength and recovery priority. Ranking by users and transaction volume measures load, and a low-volume system such as treasury payments can be far more critical than a busy intranet. Rating by vulnerability severity measures exposure, which is an input to risk once criticality is known, not a substitute for it. Asking operations how hard a system is to restore describes technical recovery effort, while the business decides how important the capability is. Exam caveat: the business owners confirm criticality; the architecture view supplies the dependency map, not the final judgement. Operational check: pick one critical capability, walk its mapping to every supporting application and platform, and confirm each one carries a matching criticality rating in the asset inventory.