How do we decide an incident's severity when the facts are still unclear?

Start

An incident is declared and the facts are still unclear

In the first hour you rarely know how far an attacker got or what data left. Severity decides who is told and how fast the response runs, so it cannot wait for certainty. The pack's default is to set it within 10 minutes of declaration.

• Then: Rate each impact area on the worst it could credibly do

Step

Rate each impact area on the worst it could credibly do

Rate service, data, spread, financial, legal and regulatory, and reputation, each from Severity 1 to 4. Judge what the incident could do next, not only what it has done. Ransomware on one PC is Severity 1 if it can spread. A mailbox rule forwarding mail outside is Severity 2 if personal data may already have gone.

• Then: Is any area still unknown, or between two levels?

Decision

Is any area still unknown, or between two levels?

Typical gaps are whether data left, whether the attacker had administrator rights, and how long a service will be down. An area you cannot yet rate is not an area you can ignore.

• Yes, or not known: Take the higher of the levels still possible
• No, every area is rated: What is the highest level any area reaches?

Step

Take the higher of the levels still possible

When in doubt, choose the higher level. Some playbooks add a floor: in the pack, confirmed ransomware is never below Severity 2, because ransomware first called less severe usually turns out to have spread further than anyone knew. Starting high and lowering later costs little; starting low delays the people who should have been told.

• Then: What is the highest level any area reaches?

Decision

What is the highest level any area reaches?

Severity is the highest level any one area reaches, not an average. One area at Severity 1 makes the incident Severity 1, whatever the others show. Record the severity with the area that set it and the reason.

• Severity 1: Severity 1: executive lead, crisis team, then board chair
• Severity 2: Severity 2: tell the executive incident lead
• Severity 3: Severity 3: incident manager leads in working hours
• Severity 4: Severity 4: service desk logs and handles it

Outcome

Severity 1: executive lead, crisis team, then board chair

For example: malware or an attacker spreading, administrator access to core systems, customer data at scale taken or likely to be, or a likely significant incident under NIS2. In the pack's defaults: the executive incident lead within 30 minutes, the crisis team within 1 hour, the board chair or equivalent within 4 hours, updates every 2 hours.

• Then: Name the fact that would settle the doubt, and get it

Outcome

Severity 2: tell the executive incident lead

For example: an internal critical service stopped, personal data of a limited number of people exposed, or one account with elevated rights compromised and contained. In the pack's defaults the executive incident lead is told within 2 hours, and updates run every 4 hours.

• Then: Name the fact that would settle the doubt, and get it

Outcome

Severity 3: incident manager leads in working hours

For example: one user account or device compromised with the attacker stopped before harm, or one system affected with no customer effect. In the pack's defaults the Head of Information Security is told the same working day, and updates run every 24 hours.

• Then: Name the fact that would settle the doubt, and get it

Outcome

Severity 4: service desk logs and handles it

An attack stopped by an existing control, with response work still needed, and no service, data or legal impact. The service desk handles it, and the Head of Information Security sees it in the weekly summary. The pack's default is closure within 5 working days.

• Then: Name the fact that would settle the doubt, and get it

Step

Name the fact that would settle the doubt, and get it

Make the open question the first task: for a mailbox takeover, check the mailbox audit log; for ransomware, check whether anything left the network. Set the next update time before anyone leaves the call.

• Then: At this update, has a fact changed the worst case?

Decision

At this update, has a fact changed the worst case?

Severity is reviewed at every update. The crisis team agenda asks it directly: severity and category, still right? Answer from evidence, not from the absence of bad news.

• Worse, or a new doubt: Raise it, and bring in the new level's people at once
• Better, shown by evidence: Lower it only on evidence, with the reason recorded
• No change: Keep the level and review it again at the next update

Step

Raise it, and bring in the new level's people at once

Anyone on the response team may raise severity. A rise brings in the people the new level requires at once, not at the next scheduled update.

• Then: What is the highest level any area reaches? (back to an earlier step)

Step

Lower it only on evidence, with the reason recorded

Only the incident manager lowers severity, with the reason in the case log. In the pack's example a mailbox takeover was declared Severity 2 and lowered to 3 within the hour, once the audit log showed no mail had been forwarded or read. Had it shown otherwise, it would have stayed at 2.

• Then: What is the highest level any area reaches? (back to an earlier step)

Outcome

Keep the level and review it again at the next update

Keep the severity until a fact changes it, and record it at each update. Severity 3 and 4 incidents are reviewed together each quarter, partly to catch any that should have been rated higher.