Incident Severity Levels
What SEV-1, SEV-2, and SEV-3 are for: who you wake, what can wait until morning, and why a longer scale turns into an argument.
An incident severity level says how badly you interrupt people. It is not a measurement of customer pain, and it is not a priority on the backlog. During the incident it answers one question: who needs to be awake, and who can read about it in the morning.
Three levels
| Level | Use it when | Who you wake |
|---|---|---|
| SEV-1 | Customers cannot do the thing they came to do, or you are losing data, and it is happening now. | Page the on-call engineer and the owner of the service. |
| SEV-2 | A serious failure with a workaround, or a smaller set of customers. It can wait an hour. It cannot wait until the next business day. | The on-call engineer. Message the owner. Do not page the company. |
| SEV-3 | Degraded, contained, or already recovered. You are writing it down so the next one is faster. | Nobody. Look at it in the morning. |
The double charge on the nightly billing job was a SEV-2. Customers were charged twice, the charges could be reversed, and nothing still happening at 3am would have been fixed by a page. A SEV-1 would have woken people who could not issue refunds until morning. A SEV-3 would have left the duplicates until someone happened to read a ticket.
Skip the extra levels
SEV-4 and SEV-5 become a drawer for things that are not incidents. The argument during the incident then becomes the number. If two people disagree, take the higher level, start, and correct it when the scope is clear. Dropping a SEV-2 to a SEV-3 after you know more is cheaper than waiting to agree.
Write the level on the postmortem. It tells the next reader how loud the response was, which is part of whether the response matched the failure. It does not replace what happened.
Keep the level with the incident
Prodigent keeps the incident, the severity, and the service together, so the next related change can see how serious the last one was.
Try Prodigent free