Why the label needs a definition
Almost every system owner will tell you their system is critical, and almost all of them are right in the sense they mean it. The label only becomes useful when it changes a decision — specifically, when it decides whether privileged access needs to be brokered, recorded, and expired, or whether documented good practice is proportionate.
Test 1 — The consequence is irreversible
Can the damage be undone by spending money after the fact? If a bad outcome means a refund, a credit, or a difficult quarter, the network is important. If it means a call that was not dispatched, evidence that cannot be used, a coalition partner exposed, or a physical process that ran outside its safe envelope, the network is mission-critical. Money afterwards does not buy any of those back.
Test 2 — There is no maintenance window when it matters
Commercial systems have quiet periods. Dispatch floors, command centres, and emergency operations centres have the opposite property: the moment they are busiest is the moment they are least able to tolerate a change, and it arrives unannounced. Access control on such a network has to be something that works during a hurricane activation without anybody deciding to switch it off — which is a design constraint, not a policy.
Test 3 — The record is evidence, not telemetry
On most networks, logs exist to help engineers debug and help security teams investigate. On a mission network, the same records are produced under subpoena, cited in an inspector general review, or presented to a court. That changes their requirements completely: they must be complete, they must be attributable to a named human, and they must be demonstrably unaltered since the moment they were written.
A log that the administrator under investigation could have edited is not evidence. A recording sealed with a digest and written into an append-only hash-chained ledger is. The technical difference is modest; the legal difference is total.
Test 4 — The adversary is deliberate and patient
Opportunistic crime looks for the easiest target. A network carrying military, law enforcement, or emergency response traffic attracts adversaries who selected it specifically, will spend months on it, and are interested in access rather than immediate gain. Their preferred route is nearly always a legitimate credential used in a way nobody watches — a vendor account, a service account, a shared administrative login, or a bastion host that was stood up for a project and never removed.
Against that profile, controls that assume an attacker is in a hurry buy less than they appear to.
Test 5 — Access is the control that fails first
Look at how the failures in your sector actually unfolded. In our sector, the reconstructions rarely describe an exotic exploit. They describe an account that should not have existed, a password that four people knew, a maintenance path left open after a project ended, or a contractor whose access outlived the contract. Where privileged access is the recurring first link, controlling it is not one security investment among many — it is the one that changes the shape of the others.
Applying the tests
Three or more is our working threshold. A hospital records system passes 1, 3, and 5. A municipal water utility passes 1, 2, and 4. A regional bank passes 3 and 5 and typically fails 1, which is why a commercial privileged access product usually serves it well. A police records system passes all five, and so does almost every defense enclave.