What is the difference between SEV1, SEV2, and SEV3?

SEV1 is a critical, business-stopping event such as a full outage or data loss, with a target acknowledgment under 15 minutes and an all-hands response. SEV2 is major degradation affecting many users with no clean workaround, typically targeting a response within 30 minutes. SEV3 is a minor or partial issue with a workaround, handled during business hours within roughly 2 to 4 hours.

What is the difference between severity and priority?

Severity measures the impact of an incident: how much is broken and how many users are affected. Priority measures the order in which the team works on it. They often align, but not always; a SEV3 cosmetic bug on a revenue page can take priority over a SEV2 affecting only an internal tool used by 5 employees.

Is SEV1 or SEV4 more severe?

SEV1 is the most severe. On a standard five-level scale running SEV1 to SEV5, the number rises as impact falls, so SEV1 is a critical outage and SEV4 or SEV5 is a cosmetic or low-impact issue. Some teams use P1 to P4 instead, where P1 is likewise the most urgent.

How does incident severity affect a status page?

Severity sets the threshold for public communication. A SEV1 typically warrants an immediate status page post and proactive customer notice, often within the first 30 minutes, while a SEV4 usually stays internal. Mapping each level to a fixed communication action keeps customers informed during genuine outages without alarming them over trivial issues.

What Is Incident Severity (SEV1, SEV2, SEV3)?

Reviewed by Ionut Caval · Updated June 2026

Incident severity is a classification scheme that ranks an incident by its business impact, so teams know how urgently to respond, who to wake up, and how widely to communicate.

Severity translates a fuzzy report ("the site is slow") into a label that drives a defined response. A clear scale removes debate during the first minutes of an outage, when every decision competes for attention. Most teams run a five-level scale (SEV1 to SEV5, with SEV1 the most severe) and tie each level to a target acknowledgment time, an escalation path, and a communication channel.

A worked severity matrix

The numbers below are typical starting points. Tune them to your traffic and risk, then write them into your runbook so they are applied consistently.

SEV1 (critical): full outage, data loss, or a security breach. All-hands response, on-call paged immediately, target acknowledgment under 15 minutes, status page updated within the first 30 minutes.
SEV2 (major): major degradation affecting many users or a core feature, with no clean workaround. On-call paged, target response under 30 minutes.
SEV3 (minor): a partial or minor issue affecting a subset of users, with a workaround available. Handled during business hours, response in 2 to 4 hours.
SEV4 to SEV5 (low impact): cosmetic bugs, isolated edge cases, or informational alerts. Logged and scheduled into normal sprint work, no paging.

Some teams label the same idea P1 to P4 (or P5) instead of SEV. The letters change but the intent is identical: a SEV1 and a P1 both mean drop everything. Pick one vocabulary across the organization so a "SEV2" means the same thing to every responder.

Severity is not priority

Severity measures impact (how much is broken and for whom). Priority measures the order in which work gets done. A SEV3 cosmetic glitch on the checkout button can carry a higher priority than a SEV2 affecting an internal admin tool, because the checkout path touches revenue. Keep the two axes separate: severity drives the urgency of the live response and feeds incident management, while priority drives the backlog and the follow-up captured in the postmortem.

Severity also sets the public bar. A SEV1 warrants an immediate status page post and proactive customer messaging, while a SEV4 usually stays internal. Mapping each severity to a fixed communication action keeps customers informed during real outages without flooding them over trivia.

Frequently asked questions

What is the difference between SEV1, SEV2, and SEV3?

SEV1 is a critical, business-stopping event such as a full outage or data loss, with a target acknowledgment under 15 minutes and an all-hands response. SEV2 is major degradation affecting many users with no clean workaround, typically targeting a response within 30 minutes. SEV3 is a minor or partial issue with a workaround, handled during business hours within roughly 2 to 4 hours.
What is the difference between severity and priority?

Severity measures the impact of an incident: how much is broken and how many users are affected. Priority measures the order in which the team works on it. They often align, but not always; a SEV3 cosmetic bug on a revenue page can take priority over a SEV2 affecting only an internal tool used by 5 employees.
Is SEV1 or SEV4 more severe?

SEV1 is the most severe. On a standard five-level scale running SEV1 to SEV5, the number rises as impact falls, so SEV1 is a critical outage and SEV4 or SEV5 is a cosmetic or low-impact issue. Some teams use P1 to P4 instead, where P1 is likewise the most urgent.
How does incident severity affect a status page?

Severity sets the threshold for public communication. A SEV1 typically warrants an immediate status page post and proactive customer notice, often within the first 30 minutes, while a SEV4 usually stays internal. Mapping each level to a fixed communication action keeps customers informed during genuine outages without alarming them over trivial issues.

Put these metrics to work. Monitor your site free.

2-minute setup · Cancel any time
Create Free Account

Your Dashboard

No credit card needed