Security Classifications

Hello,

When dealing with security classifications, many risk management models
and security standards are referring both to system Criticality and
Sensitivity, and to system Confidentiality, Integrity, and Availability
requirements. 

For example, from the ISF standard:
--------------
CB 5.2.2 
The classification scheme should be used to determine varying levels of:
a) criticality of information or systems (e.g. 'critical', 'important
but not critical' or 'other')
b) sensitivity of information or systems (e.g. 'confidential', 'strictly
confidential' or 'top secret').

CB 5.2.3 
Security classifications should:
a) take account of the possible business impact of a loss of
confidentiality, integrity or availability of information
--------------

I am not sure I understand the relation between the two classification
schemes. Is there a method to map between CIA requirements and the
Criticality\Sensitivity of systems?

Should I look at "Criticality" as a classification deriving from
"Availability" requirements, and at "Sensitivity" as a classification
deriving from "Confidentiality" and "Integrity" requirements? 

If so, how do you map the two parameters (confidentiality and integrity)
into one classification (sensitivity), 
max{integrity, confidentiality)? 

Hope someone can clear this up.

Thanks,
Nimrod