Three dimensions of incident impact
Classifying incident severity requires consistent evaluation across customer impact, scope, and reversibility. Customer impact measures how many users or how much revenue is affected by the outage. A database downtime affecting 10 percent of customers has higher impact than a visual bug affecting 100 percent. Scope describes how many systems or service areas are involved. A DNS failure that breaks login affects every service; a single report generation failure affects one feature.
Reversibility captures how easily the damage can be undone. A feature flag misconfiguration that blocks signups is highly reversible: flip the flag, customers can sign up again. A data corruption bug that silently overwrites customer records is irreversible: the damage is done and recovery requires restoration from backup. The same user count can be a Sev 2 if reversible or a Sev 1 if the damage is permanent.
Using the matrix to route response and post-incident action
A proper severity tree creates objective criteria so that every person on call applies the same logic. Sev 1 incidents (high customer impact, broad scope, or irreversible damage) trigger immediate page-out and full-team response. Sev 2 incidents (moderate impact or narrow scope) are handled by on-call engineers on standard SLA. Sev 3 (low impact, easily reversible) can wait for the next business day.
The tree also guides post-incident prioritization. A Sev 1 incident requires root cause analysis and prevention measures. A Sev 3 incident might warrant a quick fix or a low-priority backlog item. Organizations without a clear severity matrix often treat every incident as equally urgent, burn out their teams, and waste investigation time on low-impact events. Clear definitions create calm and focus.