Deciding What Not to Protect: The Crown-Jewels Conversation

Ask a security team what they protect and the honest answer is usually "everything." It sounds thorough. It is actually an admission that no one has chosen.

Security budgets are finite. Attention is finite. When everything is critical, the spreadsheet may be complete but the strategy is not. Somebody has to decide what gets protected most, and that decision belongs to the business, not to the security team alone.

The crown-jewels conversation is how a board and its executives make that choice out loud.

TLDR

• Protecting everything equally means the most important assets get an average share.

• Tier assets explicitly: most protected, less protected, least protected.

• Business owners name the assets; they own the consequences of loss.

• Spending should follow the tiers, and the board should check that it does.

• Revisit the tiers when the business changes, not on a calendar alone.

Why "protect everything" fails

Controls cost money and attention. Spread evenly, both run out before the most damaging losses are covered. The customer database and the cafeteria menu get the same control set on paper, but only one of them can end the company.

The NIST Cybersecurity Framework starts with identifying what you have - assets, systems, data - before deciding how to protect it. Identification is not an inventory exercise. It is the step where someone says these few things matter most.

The three-tier worksheet

A short worksheet forces the decision into the open. Each tier gets a named business owner and a protection level. The example below is illustrative.

Tier (illustrative)	What sits here	Business owner	Protection level
Tier 1 - Crown jewels	Customer records, payment systems, core product designs	Named executive per asset	Strongest controls, most monitoring, fastest response
Tier 2 - Important	Internal finance and HR systems, email	Department head	Standard controls, routine review
Tier 3 - Everything else	Marketing site, shared documents, test systems	IT owner	Baseline controls, accept more risk

The hard part is not filling in tier 1. It is signing tier 3 - saying, in writing, that some things get less protection and that this is a decision, not an oversight.

Spending should follow the tiers

Once the tiers exist, test the budget against them. If tier 3 tools cost more than tier 1 monitoring, the spending contradicts the stated priorities. That mismatch is exactly the kind of thing a board can spot in one slide.

Revisit when the business moves

An acquisition, a new product line or a new regulation can move an asset between tiers overnight. Review the tiers after material change, and at least annually. For the broader question of what protection level is affordable, see whether you can afford no cyber risk protection.

Frequently asked questions

Who should be in the crown-jewels conversation?

The executives who own the assets, the security leader, and a board representative. The security team brings options and costs; the business owners decide.

How many assets belong in tier 1?

Few enough to name in a minute. If tier 1 holds twenty things, it is a list, not a priority.

Is a tier 3 label an admission of weakness?

No. It is a record of a deliberate risk choice, which is stronger than an unexamined gap discovered later.

How does this connect to cyber insurance?

Insurers increasingly ask what you consider most critical and how it is protected. A signed tiering worksheet answers that question with evidence.

A Defensible Next Step

Ask for the list of the five assets whose loss would hurt most, and the name of the executive who owns each one. If that list does not exist, that is the first gap to close. Book a Decision-Clarity Call if you would like help running the conversation.