Design an ISO/IEC 27035-aligned severity and escalation matrix using impact, priority, damage, urgency, recoverability, and reporting triggers.
ISO/IEC 27035 is voluntary guidance, not a law or standalone certification scheme. Adapt it to the incident and apply separate legal, regulatory, contractual, and ISO/IEC 27001 requirements where relevant.
Structured answer sets in this page tree.
Cited legal and guidance references.
Build the matrix from the organization's services, assets, risk criteria, response authority, and external duties. ISO/IEC 27035 calls for pre-established incident criteria and a , but it does not prescribe universal severity labels, scores, or response times. Treat the first rating as provisional, reassess it as facts change, and keep legal or contractual notification thresholds separate.
First decide whether the reported event meets the organization's incident criteria. Then rate the incident using facts that affect risk and response: service or asset criticality; confidentiality, integrity, and availability impact; safety or physical impact; affected users and third parties; geographic or organizational spread; threat activity and persistence; evidence risk; recoverability; and uncertainty. Record the facts, not only the label.
Define escalation as a routing decision: which coordinator, response team, management level, specialist, supplier, continuity function, legal or privacy owner, or communications role must be involved. The organization can also define a separate response-level change for cases that need more resources or authority without changing the underlying impact rating. State these meanings in the matrix so responders do not use the terms interchangeably.
Use as many levels as the organization can apply consistently. The labels below are illustrative, not ISO-defined. A usable row ties observable conditions to an initial owner, escalation path, decision authority, communication route, response objective, and reassessment rule. Avoid vague labels such as 'major impact' unless the row explains what qualifies.
A single factor can set a minimum level or force escalation. For example, a safety concern, confirmed compromise of a critical service, evidence at risk, or a potential legal-reporting duty may require immediate specialist or management involvement even while the overall impact is uncertain. Write that override into the matrix instead of relying on memory.
Test the rows with source-supported incident types rather than abstract labels alone. A blocked malicious-email attachment with no execution or affected account may remain a low-impact event after validation. Repeated password attacks against an exposed account can rise when evidence shows compromise or spread. A denial-of-service attack against a critical public service, theft of an unencrypted device holding sensitive data, or a supply-chain backdoor can force higher escalation because service, data, third parties, recovery, and reporting analyses are involved. The final rating still depends on the organization's actual or projected consequences.
The point of contact records the event and routes it for assessment. The incident coordinator validates the available facts, decides whether it is an incident, assigns a provisional rating, activates the required roles, and sets the next reassessment. The response team then updates the rating as analysis, containment, recovery, and external reviews develop.
Do not make the arithmetic the decision. A score can support consistency, but the named decision owner should be able to override it for documented reasons. Define who can raise or lower a rating, who can approve disruptive containment, who accepts recovery, and who decides external reporting under the applicable source.
Keep the approved matrix with its owner, version, scope, review date, and change history. For each event or incident, retain the facts used, provisional and final ratings, confidence or uncertainty, decision owner, overrides, escalation and communication actions, reassessment times, and the effect of each rating change.
The incident-management log should reconstruct the sequence without exposing the record more widely than its classification permits. Link to technical evidence instead of copying sensitive material into every ticket, and preserve evidence under the organization's access, integrity, retention, and chain-of-custody rules.
Tie observable conditions to response authority, reassessment, external-duty review, and a traceable incident record.
Test the matrix with scenarios that expose ambiguity: uncertain scope, simultaneous confidentiality and availability impact, a supplier-led incident, out-of-hours decisions, evidence at risk, continuity activation, and a possible external-reporting trigger. Ask different responders to classify the same facts and investigate inconsistent results.
Review the matrix on its planned cycle and after an incident, exercise, service or supplier change, material threat change, reorganization, or change to law, contract, insurance, or continuity arrangements. Update contacts and authority limits immediately when people or responsibilities change.