> Severity classification and response framework for Acme Inc. 8 services | Generated on 2026-03-19 Document Version: 1.0 Document Owner: Acme Inc Next Review Date: 2027-03-19

## Purpose

This matrix defines severity levels for security incidents and service disruptions. It establishes response times, escalation paths, and communication requirements to ensure consistent and rapid incident handling.

## 1. Severity Level Definitions

Level | Name | Definition | Examples
--- | --- | --- | ---
P0 | Catastrophic | Complete system compromise, active data exfiltration, or regulatory breach affecting all users | Production database breach, ransomware encrypting all systems, leaked master encryption keys, complete auth bypass
P1 | Critical | Major security incident with confirmed data exposure or significant service degradation | Unauthorized access to PII, API key compromise with data access, partial service outage affecting >50% users
P2 | High | Security incident with potential data exposure or moderate service impact | Vulnerability actively exploited, unauthorized access detected but contained, service degradation affecting <50% users
P3 | Medium | Security event requiring investigation with limited immediate impact | Suspicious access patterns, failed intrusion attempts, configuration drift detected, minor data quality issues
P4 | Low | Minor security event or policy violation with no data impact | Phishing attempt blocked, minor policy violation, non-sensitive log exposure, informational security alert

## 2. Response Time Requirements

Level | Acknowledge | Triage | Initial Response | Resolution Target | Post-Mortem
--- | --- | --- | --- | --- | ---
P0 | 5 minutes | 15 minutes | 30 minutes | 4 hours | Within 24 hours
P1 | 15 minutes | 30 minutes | 1 hour | 8 hours | Within 48 hours
P2 | 30 minutes | 1 hour | 4 hours | 24 hours | Within 5 business days
P3 | 2 hours | 4 hours | 24 hours | 72 hours | Within 10 business days
P4 | 24 hours | 48 hours | 72 hours | 1 week | Monthly review

## 3. Escalation Paths

### P0 — Catastrophic

    Discoverer
      └─> Security On-Call (immediate)
           └─> CTO / CISO (within 5 min)
                └─> CEO + Legal Counsel (within 15 min)
                     └─> Board notification (within 1 hour)
                          └─> Regulatory authority (within 72 hours per GDPR)

### P1 — Critical

    Discoverer
      └─> Security On-Call (within 15 min)
           └─> Engineering Lead + Security Lead (within 30 min)
                └─> CTO / CISO (within 1 hour)
                     └─> DPO for data breach assessment

### P2 — High

    Discoverer
      └─> Security On-Call (within 30 min)
           └─> Engineering Lead (within 1 hour)
                └─> CTO (if escalation needed)

### P3/P4 — Medium/Low

    Discoverer
      └─> Security channel / ticket
           └─> Security team triage (next business day for P4)

## 4. Communication Requirements

Level | Internal Comms | Customer Comms | Regulatory Notification | Public Disclosure
--- | --- | --- | --- | ---
P0 | All-hands war room, executive updates every 30 min | Status page + direct email within 1 hour | Within 72 hours (GDPR Art. 33) to dpo@acme-saas.com | If data breach confirmed, within 72 hours
P1 | Security + engineering channel, executive update hourly | Status page update, affected users notified within 24 hours | Assess within 36 hours, notify if required | Only if legally required
P2 | Security channel, engineering lead notified | Status page if user-facing impact | Assess within 72 hours | No
P3 | Security ticket, weekly summary | No | No (unless investigation escalates) | No
P4 | Security ticket | No | No | No

## 5. Communication Channels

Channel | Used For | Access
--- | --- | ---
Security email (legal@acme.com) | External reports, regulatory correspondence | Security team
#security-incidents (Slack/Teams) | Real-time incident coordination | Security + engineering
War room (video call) | P0/P1 live coordination | All responders
Incident management tool | Ticket tracking, timeline documentation | All staff
Status page | Customer-facing incident updates | Public

## 6. Per-Service Impact Assessment

Severity classification when each detected service is compromised or experiences an outage.

Service | Category | If Compromised | If Outage | Data at Risk | Regulatory Impact
--- | --- | --- | --- | --- | ---
@sentry/node | monitoring | P2 | P2 | error data, stack traces, user context | Minimal direct regulatory impact
@supabase/supabase-js | auth | P0 | P1 | email, password hash, session data | GDPR Art. 33/34, credential breach notification
openai | ai | P0 | P2 | user prompts, conversation history, generated content | EU AI Act, GDPR Art. 22 (automated decisions)
posthog | analytics | P1 | P3 | user behavior, session recordings, feature flag usage | ePrivacy, GDPR Art. 6/7 (consent)
prisma | database | P0 | P1 | user data as defined in schema | GDPR Art. 33/34, data breach notification
resend | email | P1 | P2 | email addresses, email content | CAN-SPAM, GDPR Art. 33/34
stripe | payment | P0 | P1 | payment information, billing address, email | PCI DSS, GDPR Art. 33/34
stripe-ios | payment | P0 | P1 | payment information, billing address, email | PCI DSS, GDPR Art. 33/34

## 7. Category-Specific Incident Scenarios

### AI Services

Scenario | Severity | Response Action
--- | --- | ---
User PII leaked through AI prompts | P0 | Disable AI feature, assess data exposure, notify affected users
Prompt injection bypasses safety controls | P1 | Throttle AI endpoint, deploy input validation fix, audit recent outputs
AI model produces biased/discriminatory output | P2 | Document instances, add guardrails, notify AI ethics team
AI service provider data breach | P1 | Assess data shared with provider, rotate API keys, review DPA obligations
AI hallucination causes user harm | P2 | Add output disclaimers, review and strengthen validation layer

### Payment Services

Scenario | Severity | Response Action
--- | --- | ---
Cardholder data exposed | P0 | Isolate systems, notify payment processor within 24h, engage PCI forensic investigator
Payment processing outage | P1 | Activate backup processor, communicate to affected customers
Fraudulent transactions detected | P2 | Flag accounts, review transaction logs, strengthen fraud detection
PCI DSS compliance gap discovered | P3 | Document gap, create remediation plan, assess risk

### Authentication Services

Scenario | Severity | Response Action
--- | --- | ---
Complete auth bypass discovered | P0 | Disable affected auth flow, force re-authentication, rotate all sessions
Credential stuffing attack in progress | P1 | Enable rate limiting, lock affected accounts, force password resets
OAuth token leak | P1 | Revoke leaked tokens, rotate secrets, audit access logs
Auth provider outage | P2 | Activate fallback auth, communicate login issues to users

### Database & Storage Services

Scenario | Severity | Response Action
--- | --- | ---
Database exposed to internet | P0 | Restrict network access immediately, audit data access logs, rotate credentials
Unauthorized database query detected | P1 | Revoke access, investigate query scope, assess data exposure
Storage bucket misconfiguration | P1 | Lock down permissions, audit exposed files, notify if PII exposed
Database corruption / data loss | P2 | Activate backup restoration, assess data integrity

### Analytics Services

Scenario | Severity | Response Action
--- | --- | ---
Analytics collecting PII without consent | P2 | Disable data collection, audit consent records, update cookie consent config
Analytics data shared with unauthorized third party | P1 | Revoke access, assess GDPR Art. 33 notification requirement
Analytics tracking across domains without disclosure | P3 | Update privacy policy, reconfigure tracking parameters

## 8. Severity Decision Tree

Use this decision tree to classify incidents when severity is unclear:

    Is there confirmed data exfiltration or complete system compromise?
      ├─ YES → P0 (Catastrophic)
      └─ NO
           Is there confirmed unauthorized access to PII or critical systems?
           ├─ YES → P1 (Critical)
           └─ NO
                Is there an active exploit or significant service degradation?
                ├─ YES → P2 (High)
                └─ NO
                     Is investigation required to determine impact?
                     ├─ YES → P3 (Medium)
                     └─ NO → P4 (Low)

## 9. Regulatory Response Timelines

Mandatory notification deadlines by regulation for data breach incidents (P0/P1).

Regulation | Authority Notification | Individual Notification | Key Requirement
--- | --- | --- | ---
GDPR (Art. 33/34) | 72 hours | Without undue delay (high risk) | Must document all breaches regardless of notification
UK GDPR | 72 hours | Without undue delay (high risk) | Notify ICO via online portal
CCPA/CPRA | Varies by state | Without unreasonable delay | AG notification for 500+ CA residents
PCI DSS | 24 hours (to processor) | As required | Engage PCI Forensic Investigator (PFI)
EU AI Act | As required by severity | Depends on risk level | Additional obligations for high-risk AI systems
ePrivacy | Per member state law | Per member state law | Cookie/tracking specific requirements

## 10. Incident Response Roles

Role | P0 Responsibility | P1-P2 Responsibility | P3-P4 Responsibility
--- | --- | --- | ---
Incident Commander | Leads war room, all decisions | Coordinates response | Reviews report
Security Lead | Active investigation, containment | Investigation lead | Triages tickets
Engineering Lead | Emergency fixes, system isolation | Deploys fixes | Assigns fixes
DPO (dpo@acme-saas.com) | Regulatory notification decision | Breach assessment | Monthly review
Communications Lead | Customer + public messaging | Status page updates | No action
Legal Counsel | Regulatory response, evidence preservation | Legal assessment | No action
Executive Sponsor | Final authority, board comms | Informed, escalation | Informed via report

This incident severity matrix was generated by Codepliant based on an automated scan of the nextjs-saas-example codebase (8 services detected). Customize response times, escalation paths, and roles to match your organization's structure. This document should be reviewed by your security team and legal counsel before adoption.