A clear severity scale tells everyone how much effort and escalation is needed. Severity should consider business impact, data involved and how far the attack has spread.
Why it matters
For Incident Response, severity is rarely a purely technical question. It touches ownership, budget and how quickly decisions can be made when something goes wrong. Teams that agree on these points in advance spend less time debating them under pressure.
What to check
- Use a simple three or four level scale
- Link each level to who must be informed
- Review severity as facts change
Where to start
Declaring early is better than declaring late. Write down what you decide, who owns it and when it will be reviewed. That record is often the evidence a reviewer asks for later.