Asset Criticality Scoring
Qualys assigns an Asset Criticality Score (ACS) on a scale of 1 to 5. These values directly influence TruRisk scores and remediation prioritization, so define them early.
ACS Score |
Classification |
Typical Asset Examples |
| 5: Critical | Mission-critical systems | Core financial systems, authentication servers, patient data repositories, OT/ICS interfaces |
| 4: High | Business-critical systems | ERP, CRM, HR platforms, primary web-facing applications |
| 3: Medium | Important systems | Internal business applications, secondary infrastructure, developer workstations |
| 2: Low | Standard systems | General user workstations, standard servers, test environments |
| 1: Minimal | Non-critical assets | Lab machines, decommissioning systems, isolated test benches |
Default ACS: Newly discovered assets receive a default ACS of 2 until you assign a value. Review this baseline early. Leaving high-value systems at the default understates their TruRisk score and can push urgent remediation down your queue. Assign accurate criticality to your most important assets first.
Identify your highest-value assets first. Accurate criticality scoring guides remediation toward the actions that remove the greatest risk from your environment.