Key prioritization criteria

Use robust criteria: data sensitivity (confidential, regulated, critical), data lifetime (confidential beyond 5–10 years?), system criticality, cryptographic exposure (asymmetric used?), dependency and control (internal vs vendor). Prioritisation should be documented, not intuitive; it enables risk tiers and clear trade-offs.