An asset is anything of value to your organisation that could be impacted if something goes wrong. It's the logical starting point for risk management: if you don't know what you're protecting, you can't know what to protect.
Business software (ERP, CRM, helpdesk, customer-facing platform).
Server, network, datacentre, endpoints, VPN.
Customer database, HR records, source code, backups, logs.
Agreement with a third party: hosting, supplier, insurance.
Key skill (internal or outsourced): DPO, CISO, senior dev.
Critical vendor: AWS, Microsoft, subcontractor.
Essential business procedure: on/off-boarding, access management, deployment, incident response.
Criticality represents importance to the business — not a monetary value. Ask yourself: "if this asset disappears tomorrow, what happens to my company?"
Don't try to inventory all your infrastructure. Focus on the 10 to 30 critical assets that cover 80% of your exposure. Auditors prefer a short, accurate inventory over an exhaustive but fuzzy listing.