Incident severity levels
Sev 1 — Critical
A major loss of confidentiality, integrity or availability.
e.g.
Customer database exposed to the public internet.
Sev 2 — High
Significant impact, but contained to part of the service.
e.g.
One client's data sent to another client.
Sev 3 — Medium
A real but limited impact, resolved quickly.
e.g.
A brief service outage, resolved well within SLA.
Sev 4 — Low
A minor confirmed breach with little or no harm.
e.g.
A low-sensitivity file emailed to the wrong external recipient.