Functions
What is a Function?
A Function represents a business activity your organization performs — such as processing payments, onboarding clients, or producing regulatory reports. Functions describe what the business does, while Assets describe what it runs on. Functions are defined under configuration and are not Assets themselves; instead, Assets are linked to the Functions they support.
By linking Assets to Functions, you can see which applications, reports, AI agents, and external providers each activity relies on — and which Functions are affected when an Asset fails or changes.
What is a Critical Function?
A Function is critical when a disruption would seriously harm your clients, your organization, or the wider market. Flagging these Functions helps you focus your risk and resilience work where it matters most.
Why this matters in regulated environments:
In the financial sector, identifying critical functions is often a regulatory requirement. For example, DORA (EU) asks financial entities to identify their critical or important functions and map the ICT assets and third-party providers that support them. FINMA (Switzerland) asks banks and insurers to define their critical functions, set how much disruption each can tolerate, and know which resources they depend on. In both cases, the core idea is the same: know which activities matter most, know what they depend on, and be able to show it.
In short:
A Function answers "what does the business do?" — while an Asset answers "what system, application, or deliverable supports it?", and the critical flag answers "how much would a disruption hurt?"
A Function represents a business activity your organization performs — such as processing payments, onboarding clients, or producing regulatory reports. Functions describe what the business does, while Assets describe what it runs on. Functions are defined under configuration and are not Assets themselves; instead, Assets are linked to the Functions they support.
By linking Assets to Functions, you can see which applications, reports, AI agents, and external providers each activity relies on — and which Functions are affected when an Asset fails or changes.
What is a Critical Function?
A Function is critical when a disruption would seriously harm your clients, your organization, or the wider market. Flagging these Functions helps you focus your risk and resilience work where it matters most.
Why this matters in regulated environments:
In the financial sector, identifying critical functions is often a regulatory requirement. For example, DORA (EU) asks financial entities to identify their critical or important functions and map the ICT assets and third-party providers that support them. FINMA (Switzerland) asks banks and insurers to define their critical functions, set how much disruption each can tolerate, and know which resources they depend on. In both cases, the core idea is the same: know which activities matter most, know what they depend on, and be able to show it.
In short:
A Function answers "what does the business do?" — while an Asset answers "what system, application, or deliverable supports it?", and the critical flag answers "how much would a disruption hurt?"