What it means
Incident severity classification assigns a consistent priority using factors such as mission impact, data sensitivity, scope, safety, legal obligations, adversary activity, and recovery difficulty.
Why it matters
Consistent severity helps activate the right resources and reporting without allowing the loudest alert to determine priority.
Practical focus
- Define severity criteria and examples
- Allow reclassification as evidence changes
- Separate technical severity from business impact
- Tie levels to notification and authority requirements
Common mistakes
- Using one score without context
- Classifying only from alert type
- Delaying reclassification when impact expands
- Confusing urgency with severity
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: