Most matrices cover reach and impact. Sophisticated organizations add a third dimension: time sensitivity — how quickly does this incident become catastrophically worse if left unresolved?
Why Time Matters
Some incidents are stable at their current severity. A broken "Export to CSV" button is a SEV3 at 9 AM and still a SEV3 at 9 PM. It does not get worse on its own.
Other incidents have hard deadlines baked into the business context. A payroll processing failure at 11 PM on the 14th of the month is a SEV1 because payroll runs at midnight. The exact same failure at 11 PM on the 5th of the month might be a SEV2 — urgent, but not catastrophic, because the deadline is ten days away.
Time-Sensitive Severity Escalation Rules
A practical way to encode time sensitivity is through automatic escalation triggers:
- Rule 1 — Deadline Proximity: If an incident affects a time-bound process (payroll, end-of-day financial reconciliation, scheduled batch jobs) and the deadline is within 2 hours, escalate one severity level.
- Rule 2 — Trending Degradation: If metrics show the incident is worsening (error rate increasing, latency climbing), escalate one severity level even if current measurements don't yet meet the higher threshold.
- Rule 3 — SLA Breach Imminent: If a customer SLA will be breached within the next 30 minutes at the current rate of degradation, treat it as if the breach has already occurred.
Encoding Time in Your Runbook
Your severity matrix documentation should include a "Time Modifiers" section:
TIME MODIFIERS
--------------
+1 Severity Level if:
- Incident occurs within 2 hours of a scheduled payroll run
- Incident occurs within 1 hour of market open/close (for fintech)
- Incident occurs during a scheduled maintenance window for a customer
- Error rate has increased >20% in the last 15 minutes
-1 Severity Level if:
- Incident occurs on a non-business day AND affects only non-critical features
- Affected customer has explicitly acknowledged the issue and accepted delay
Key Point: Time sensitivity is the most commonly overlooked dimension in severity matrices. A static snapshot of "how bad is it right now" is incomplete without asking "how bad will it be in 30 minutes if nothing changes?"