Classifying incident severity: a simple matrix for impact and urgency

Why severity matters

Severity decides who gets woken up, which service level applies, whether leadership and legal are informed, and how much disruption containment can cause. Without an agreed scale, every incident becomes either a crisis or an afterthought depending on who notices it.

A practical matrix

Rate three dimensions. Functional impact: none, low (minor service degradation), medium (a critical service is degraded for some users), high (a critical service is down). Information impact: none, internal data, sensitive personal or regulated data, or intellectual property. Scope: one host or user, a team or site, or many systems across the organization. The highest rating usually sets the severity, adjusted for whether the attacker is still active.

• SEV-1: critical service down, regulated data exposed, or active attacker across many systems
• SEV-2: limited outage or sensitive data at risk on a few systems
• SEV-3: single host or account, contained, no sensitive data
• SEV-4: policy violation or blocked attempt

Lab: rate five scenarios

Rate each scenario with your matrix and write one sentence of justification: a blocked phishing email; one laptop with commodity malware, isolated; an exposed storage bucket containing customer records, found by a researcher; ransomware encrypting a file server; and a compromised admin account with sign-ins from an unknown country in the last hour. Compare your ratings with a colleague and refine the definitions where you disagreed.

Severity changes

Reassess severity as facts arrive. An incident that starts as one infected laptop becomes SEV-1 when you find the same malware on domain controllers. Record each change with the reason and time in the incident log.