ISO/IEC 27035 FAQ Severity Classification

Base the rating on actual or projected adverse consequences for the organization's operations, individuals, and other organizations. Useful criteria include asset or service criticality, confidentiality, integrity and availability impact, scope, affected parties, spread, threat activity, recoverability, safety, and uncertainty. ISO examples include partial or complete interruption of core services, minor or large disclosure of sensitive information, system destruction, network failure, physical damage, infrastructure failure, malware, technical attack, rule breach, and compromise of information.

Keep category, severity, urgency, and notification analysis distinct. Severity expresses impact under the organization's scale; priority also reflects time and response needs. A statutory or contractual reporting threshold must be assessed against its own wording.

Define each level with observable impact or consequence criteria, examples, required response roles, authority, target times, communication route, escalation trigger, and exit criteria. Avoid labels such as low, medium, and high without tests that different assessors can apply consistently. ISO/IEC 27035-3 includes an informative four-level example, but its names and thresholds are not mandatory and should not be copied without adapting them to the organization's services and risk.

For each case, retain the initial rating, evidence used, uncertainty, assessor, time, and required actions. Add later ratings instead of overwriting the first one so the record shows how the incident evolved.

The incident coordinator should assess the event or incident against the approved scale and assign the initial rating, with input from affected business, asset, service, privacy, safety, and supplier owners as needed. The policy should identify who may confirm, raise, or lower each level.

The rating should activate response resources and authority, not wait for a committee. Decisions outside delegated authority, including crisis activation or material business interruption, should follow the escalation path.

Reassess after analysis, containment attempts, discovery of additional affected systems or people, recovery setbacks, supplier updates, or a change in legal or contractual notification analysis. Review at the frequency set for the current level and whenever the incident leaves its defined criteria.

A lower rating should follow evidence that impact and uncertainty have reduced, not only elapsed time. Record the new rating, time, facts, decision maker, and changes to resources, communications, or targets.

ISO/IEC 27035-1:2023 supplies the generic process and roles. ISO/IEC 27035-2:2023 covers planning for categorization, evaluation, prioritization, forms, escalation, and response capability. ISO/IEC 27035-3:2020 covers operational triage and gives informative examples based on incident type, impact, information or system importance, damage scale, alarm level and severity, organizational spread, and financial loss. The examples illustrate a method and do not create a universal scoring formula.

The series is voluntary global guidance for organizations of any type, size, or nature. It does not create a certification class, legal incident category, regulator threshold, notification deadline, recovery objective, or service-level target. Apply binding laws, regulator rules, contracts, insurance terms, safety duties, and customer commitments against their own wording even when the internal severity stays unchanged.