What a severity level is
A SEV level expresses how serious an incident isand guides how urgently the team responds
When something breaks, people disagree on whether it needs everyone right now or can wait for tomorrow. That disagreement costs time in both directions: a slow response to a real outage, or an unnecessary all-hands scramble. SEV levels settle the question in advance.
Once a level is agreed, it also decides who gets told, how much other work stops, and whether a postmortem gets written afterwards.
What each level means
Level | Definition | Examples | Response | Postmortem |
|---|---|---|---|---|
SEV1 | A critical failure affecting many users. Requires executive reporting and external notice | An SLA breach caused by a long outage; discovery of a vulnerability that could leak data | Major incident. Appoint an incident commander and notify people inside and outside the company | Required |
SEV2 | A critical failure that leaves many users unable to use the service | Almost nobody can use the screens, or performance has dropped sharply | Major incident. Appoint an incident commander and respond | Required |
SEV3 | Affects some users, or threatens stability. The owning team should act right away | One feature is down; a single machine failing takes the system with it | The owning team investigates as its top priority and considers a rollback | Optional |
SEV4 | Needs attention, but users are not affected | Degraded performance or latency, a single machine failure, a non-critical scheduled job failing | The owning team handles it ahead of routine work | Optional |
SEV5 | No effect on use — cosmetic issues and minor bugs | A bug with no immediate impact, a broken layout | Log it as a ticket for the owner to pick up | Optional |
Definitions, examples and responses are based on the PagerDuty Incident Response Documentation; whether a postmortem is required follows the Atlassian Incident Management Handbook.
Making it work in practice
Set the level in the first message
Waiting for the root cause is too late. Assign a provisional level as soon as the blast radius is visible, and adjust it openly as the investigation changes the picture.
When in doubt, go higher
Under-calling an incident costs more than over-calling one. It is always easy to step a level down later.
SEV1 and SEV2 are not closed until the review is done
For major incidents, writing the postmortem is part of the response, not an optional follow-up.