The assessment of availability can be adjusted, in several ways:
§ establishing exact dependencies between assets
§ nullifying the value
§ marking some qualifiers (see below)
If the asset is marked as "[availability.easy]" (see asset classes), then the availability value is reduced by an order of magnitude (3 levels in the level rating scale). This adjustment will be reflected in the assessment of the impact of threats. The local value is reduced without affecting the value that is further propagated down the dependencies.
If the asset is marked as "[availability.none]" (see asset classes), then the availability value is reduced to zero. This adjustment will be reflected in the assessment of the impact of threats. The local value is reduced without affecting the value that is further propagated down the dependencies.
If the asset is marked as "[or]" and it depends on more than 1 child, availability is not forwarded to its children or to the following assets in the transfer chain. However, if the further down in the transfer chain, the various branches converge at a common asset, the availability value is recovered again. So, alternative paths do have no availability requirements, but a single point of failure does.
The following example shows how the redundant equipment C31 and C32 are not valued in availability, while the common asset, C4, recovers value. Note that other dimensions are not affected by classification as OR.
|
|
|
Related topics