Here is a standard matrix you can copy, adapt, and store in your runbook repository. The goal is to have this document linked from every incident channel so any engineer can look it up in under 10 seconds.
| All Customers (>50%) | Major Segment (>10%) | Minor Segment (<1%) | |
|---|---|---|---|
| Data Loss / Breach | SEV0 (Crisis) | SEV0 (Crisis) | SEV1 (Critical) |
| Total Unavailability | SEV1 (Critical) | SEV1 (Critical) | SEV2 (Major) |
| Core Feature Broken | SEV1 (Critical) | SEV2 (Major) | SEV3 (Minor) |
| Performance Degraded | SEV2 (Major) | SEV3 (Minor) | SEV3 (Minor) |
| Cosmetic Issue | SEV4 (Trivial) | SEV4 (Trivial) | SEV5 (None) |
Severity Level Definitions
Each level carries specific response obligations. These are not suggestions — they are contracts between the engineering team and the business.
-
SEV0 (Crisis): Company survival or legal standing is at risk. Data has been lost or exposed. Legal, PR, and executive leadership must be notified immediately, regardless of time of day. A dedicated War Room is opened. Normal change-freeze protocols apply — no deployments until the incident is resolved.
-
SEV1 (Critical): Revenue is being lost right now, or a core user workflow is completely broken for a large portion of users. Wake up the Incident Commander, the on-call engineer for the affected service, and the engineering manager. Response SLA is typically under 15 minutes.
-
SEV2 (Major): Service is hurt but not dead. Revenue impact is minor or deferred. Users are frustrated but can still complete their primary task. Response SLA is typically within 1 hour. No need to wake people up outside business hours unless it is trending toward SEV1.
-
SEV3 (Minor): A small subset of users is affected, or a non-critical feature is broken. Ticket is created and prioritized for the next business day. No on-call escalation required.
-
SEV4/SEV5 (Trivial/None): Cosmetic issues or minor UX annoyances. Handled through normal sprint planning.
The "When in Doubt, Escalate" Rule
A well-designed matrix handles 90% of cases unambiguously. For the remaining 10% — edge cases, novel failure modes, ambiguous metrics — the standing rule should always be: escalate to the higher severity and downgrade later if warranted. The cost of a false SEV1 (waking someone up unnecessarily) is far lower than the cost of a missed SEV1 (a real outage going unmanaged for an hour).
A common SRE interview question is: "What do you do when you can't determine the severity of an incident?" The answer interviewers want is: "Default to the higher severity. You can always downgrade once you have more information. The asymmetry of risk means under-escalation is almost always more costly than over-escalation."
Key Point: The matrix is a decision accelerator, not a bureaucratic checklist. Its value is that it makes the right answer obvious in under 30 seconds, even at 2 AM when your brain is not fully awake.