Incident Severity & Playbook Router
The first hour of an incident is mostly four questions: how bad is it, which playbook do we open, who do we wake up, and which clocks have started? Tick what you are seeing, answer a few impact questions, and get all four on one screen — with links to the checklists and labs for each playbook.
1. What are you seeing?
Tick every signal that applies. They come from the triggers of each domain playbook.
2. What is the impact so far?
Answer with what you know now. Re-run as facts change; severity can go up or down.
3. Which rules may apply to you?
Optional. Adds the matching notification clocks. These are summaries; confirm with counsel which apply.
What the router does
- Tick the signals you are seeing and answer a few impact questions; the router returns a severity level from SEV1 (critical) to SEV4 (low) with a plain definition and update cadence.
- It ranks which of the 12 domain playbooks to open — identity, email/BEC, data breach, ransomware, network, DevSecOps, cloud, OT, third party, AI system, insider, M&A — alongside the master plan.
- It lists who to wake up for that level and those playbooks, and the notification clocks that may apply (GDPR, NIS2, DORA, SEC, Australia NDB, HIPAA, US states, insurance and contracts).
- Severity rounds up, not down: the highest impact you tick sets the floor. Re-run it as facts change.
- Copy a plain-text summary for the incident channel. Runs in your browser; nothing is sent anywhere.
Frequently asked questions
What do SEV1 to SEV4 mean here?
SEV1 (critical) is business-wide disruption, a safety risk, confirmed theft of sensitive data at scale, active extortion or public exposure. SEV2 (high) is a confirmed compromise of a critical service, privileged account or sensitive data that is still contained to part of the business. SEV3 (medium) is a confirmed incident with limited impact. SEV4 (low) is a suspicious event or minor incident on a single user or device. Use your own plan's definitions if they differ; the point is that everyone uses the same ones.
How does the router decide the severity?
Each impact answer sets a minimum level: a safety risk or several critical services down sets SEV1; a critical service down, a high-impact signal such as a privileged account takeover, or confirmed theft of sensitive data sets SEV2; any confirmed signal sets SEV3. The highest minimum wins. It is a transparent rule set, not a model, and it rounds up when in doubt.
Are the notification deadlines legal advice?
No. They are short, carefully worded summaries of common regimes — for example GDPR's 72 hours to the supervisory authority after becoming aware, NIS2's 24-hour early warning, and the SEC's four business days after determining materiality. Whether a regime applies, and when its clock starts, depends on the facts. Confirm with counsel.
Why does it always include the master plan?
Every incident shares the same decisions: who is in charge, what severity it is, who is told, and who decides on notification. Those live in the master incident response plan. Domain playbooks add the technical steps for that type of incident.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.