Quick Ref: Incident Severity
Recall the distinctions that make incident severity decisions defensible.
Severity versus priority A medium-severity event can be high priority if action must happen now. What does confidence mean in an incident brief? How strongly the evidence supports the claim, stated with the reason and limits. Example: medium-high because two independent sources agree, but impact is not yet confirmed. Objection: 'Every ransomware alert is severity one.' Every ransomware alert is severity one, so why are we debating? Incident lead line We should treat it as urgent, but severity depends on scope and impact. Right now we have high priority, medium-high confidence, and unconfirmed business impact. Collapsing urgency and severity can…
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in