A board paper is important. A client proposal is important. A signature before Friday may even be urgent.
None of that makes them critical. If every project, customer request and internal deadline is labelled critical, the word stops helping you allocate attention, resilience investment and decision authority.
Critical should mean something stronger than “we care about this.”
If this fails, unacceptable harm follows—and the organisation cannot simply continue as normal.
Think about firefighters responding to a building fire. Their communications, breathing equipment and access to reliable information are not merely useful. Failure can cost lives. That is criticality: not importance as a feeling, but consequence as a fact.
Three Words Boards Keep Collapsing
Boards need a vocabulary that can survive a noisy week.
Critical describes importance of a particular kind: failure would cause unacceptable harm to people, essential services, regulated obligations, core operations, or the organisation’s survival. A system can be critical while operating normally. The label is about what happens if it fails, not about how loudly someone is asking for it today.
Urgent describes a clock. A deadline is close; delay has a cost; normal governance can still operate. A non-critical task can be urgent. That is allowed. It is not an invitation to activate crisis machinery.
Emergency describes the situation and the required response: a serious actual or imminent threat that needs immediate, coordinated, non-routine action. Workplace-emergency guidance similarly focuses on threats to people, operations, property, or the environment.
The sharpest formulation: critical describes importance; emergency describes the situation and the required response. Mixing them is how a late signature ends up competing with a live cyber incident for the same people.
What Criticality Can Attach To
In business, the harm is not always fire. It is still harm.
- Human safety
- Continuity of an essential service
- Integrity of money or data
- Legal or regulatory obligations
- The organisation’s ability to operate or survive
A material cyber incident can be a genuine business emergency. An ordinary client document awaiting signature normally is not. NIST’s distinction is useful here: a routine cyber event is an observable occurrence; a cyber incident actually or imminently jeopardizes confidentiality, integrity, or availability. The same discipline belongs on the rest of the agenda. Unusual is not the same as unacceptable.
A Simple Board-Level Test
Ask:
What unacceptable outcome occurs if this fails—and how quickly?
If nobody can answer that clearly, the item may be important, but its criticality has not been demonstrated. You have been given an adjective. You have not been given a classification.
The point of the word is not to flatter the team that owns the work. It is to decide where money, testing, escalation rights and board attention actually go. Everything cannot go there. That is the whole problem.
Board question: Which five capabilities would cause unacceptable harm if they failed today?
Relevant Sources
- Cybersecurity Incident — NIST CSRC Glossary — https://csrc.nist.gov/glossary/term/cybersecurity_incident
- Event — NIST CSRC Glossary — https://csrc.nist.gov/glossary/term/event
- Emergency Preparedness and Response: Getting Started — OSHA — https://www.osha.gov/emergency-preparedness
If your board uses “critical” as a synonym for “important,” you do not have a resilience map. You have a thesaurus. I work with directors on the classification that actually changes investment and authority. Contact me.