Incident Severity & SLA Calculator
Impact × urgency in, a priority tier and realistic remediation SLA out.
When an incident starts, the first argument is always about how bad it is. A priority matrix settles that in advance: impact times urgency gives a priority, and priority maps to a response time everyone already agreed to when nobody was panicking.
How to use it
- Choose an Impact level — data exposure or outage, degraded service, or cosmetic.
- Choose an Urgency level — actively exploited, exploitable but not observed, or theoretical.
- Read the resulting priority score and SLA tier.
What to take away
Impact and urgency are genuinely different
A critical flaw nobody is exploiting is high impact, low urgency. A noisy scanner hitting a trivial bug is the reverse. Collapsing them into one "severity" number is what causes triage arguments.
The clock behaviour is part of the tier
P1 and P2 usually run 24×7 with the clock never stopping. P3 and P4 typically pause overnight and at weekends. Agreeing this beforehand prevents a very unpleasant conversation later.
Priority is allowed to change
New information should re-triage an incident in either direction. What must not happen is a silent change with no record of who decided it.
Frequently asked questions
What does P1 mean?
The highest priority tier: critical impact needing immediate response, typically with 24×7 engagement and executive notification. Exact definitions vary by organisation, which is why they must be written down.
How is this different from a CVSS score?
CVSS scores the vulnerability in the abstract. This scores the incident in your environment right now, including whether anyone is actually exploiting it. A 9.8 on a decommissioned box is not a P1.
Who should set the priority?
The incident commander, using an agreed matrix rather than instinct. The matrix exists so that the decision is defensible afterwards.
Where this fits in the course
This security tool pairs with Path 22 — DevSecOps & AppSec — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Incident Response Tabletop — A branching ransomware scenario. Make the containment and communication calls a real incident commander has to make under pressure.
- CVSS 4.0 + 3.1 Calculator — Build a CVSS vector and calculate Base, Threat, and Environmental severity locally.
- Risk Register Builder — Add risks with likelihood and impact, get an auto-scored severity, and export the register as Markdown.
- Vulnerability Report Writer — A guided form that forces good structure — title, severity, steps to reproduce, impact, remediation — then exports clean Markdown or a printable PDF.