Severity Levels
also called SEV Levels
A predefined scale of incident impact that determines who is woken, how fast, and what process applies.
The purpose is to make the response proportionate without a negotiation during the event. A typical scale: SEV1 total or critical loss of service — page everyone, notify executives, all-hands. SEV2 significant degradation or a major feature down — page the owning team, incident channel. SEV3 minor or contained — normal working hours. SEV4 cosmetic — a ticket.
Two design choices matter. Define severity by customer impact, not by cause: "payments failing for all customers" is SEV1 whether the cause is a database, a third party or a deployment. And anyone may declare, with escalation being cheap and de-escalation being normal — a culture where declaring feels like an accusation produces under-reported incidents and slow responses.
Each level should carry an explicit commitment: response time, communication cadence, whether a postmortem is mandatory. Without those, severity is a label rather than a control.