<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: building-incident-severity-matrices
description: >-
  Design multi-factor severity matrices combining functional impact, information impact, asset criticality, and recoverability for consistent severity ratings.
domain: cybersecurity
subdomain: incident-management
tags:
  - severity
  - matrix
  - impact
  - sla
  - scoring
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["TA0040"]
  nist-csf: ["RS.AN-1", "RS.RP-1"]
  frameworks: ["NIST SP 800-61", "ISO 27035"]
---

# Building Incident Severity Matrices

## Overview

A severity matrix replaces subjective judgment with structured scoring that
combines multiple impact factors for consistent severity ratings, driving
appropriate resource allocation and SLA enforcement.

## Multi-Factor Scoring (0-3 each)

```
FACTOR 1 — Functional Impact: NONE(0) | LOW(1) | MEDIUM(2) | HIGH(3)
FACTOR 2 — Information Impact: NONE(0) | PRIVACY(1) | PROPRIETARY(2) | REGULATED(3)
FACTOR 3 — Asset Criticality: LOW(0) | MEDIUM(1) | HIGH(2) | CRITICAL(3)
FACTOR 4 — Recoverability: IMMEDIATE(0) | REGULAR(1) | EXTENDED(2) | NOT_RECOVERABLE(3)
```

## Composite Score → Severity

| Score | Severity | Label | SLA |
|-------|---------|-------|-----|
| 10–12 | S1 | CRITICAL | 5 min ack, 1 hr contain |
| 7–9 | S2 | HIGH | 15 min ack, 4 hr contain |
| 4–6 | S3 | MEDIUM | 1 hr ack, 24 hr contain |
| 0–3 | S4 | LOW | 4 hr ack, 72 hr contain |

## S1 Override Rules

```
AUTOMATIC S1 (regardless of score):
├── Active ransomware deployment
├── Confirmed regulated data exfiltration
├── Authentication infrastructure loss
├── Nation-state intrusion
└── Safety-critical system compromise
```

## Workflow

Follow the structured procedure outlined in Key Concepts above.

## Verification

- [ ] All four scoring factors defined with clear criteria
- [ ] Composite score thresholds approved by stakeholders
- [ ] Override rules documented and trained
- [ ] SLA targets achievable and resourced
