Does your organization have documented criteria for estimating the severity of security incidents?

Established severity criteria help organizations consistently evaluate and prioritize security incidents based on factors like impact to systems, data sensitivity, and business operations. Without clear criteria, incident response may be inconsistent, leading to improper resource allocation or delayed response to critical incidents. Evidence could include a documented incident severity matrix or scoring system that defines different severity levels (e.g., critical, high, medium, low) with specific criteria for each level, such as number of affected systems, type of data compromised, or operational impact thresholds.