P1/P2/P3/P4 Severity Tiers
Definition
A common four-level severity classification used in SLA structures. P1 (Critical) carries the shortest time windows; P4 (Low) carries the longest. The exact definitions of each tier, and the SLA targets attached to them, vary by organisation but must be documented in the IR plan.
- Levels
- P1 (Critical) through P4 (Low)
- Use
- SLA-linked incident severity classification
- P1 characteristic
- Shortest response and resolution time windows
- Variability
- Exact definitions and SLA targets vary by organisation
Common questions
Why must an organisation document its own P1 to P4 definitions rather than use a generic standard?+
Because no single universal definition exists, an undocumented severity scheme leaves response obligations ambiguous during an actual incident, so the IR plan must spell out exactly what qualifies each tier and what SLA clock applies to it.
Can an incident's severity tier change after initial classification?+
Yes, severity is typically reassessed as new information emerges during an investigation, for example an incident initially triaged as P3 may be escalated to P1 once data exfiltration or ransomware deployment is confirmed.
Related terms
- Contact Tree
- A structured list of individuals and teams to notify during an incident, showing the order of contact and the conditions under which...
- Escalation Criteria
- The documented conditions that require an analyst to transfer an incident to a higher tier or to external stakeholders. Examples include: severity...
- Handoff Package
- The bundle of information an analyst prepares before transferring an incident to a higher tier. Contents include incident ID, timeline, severity, containment...
- Service-Level Agreement (SLA)
- A policy or contractual commitment defining how quickly the SOC must perform specific actions (acknowledge, escalate, contain, resolve) for incidents of each...
- SLA Breach
- An instance where a required action was not completed before its SLA timer expired. Each breach is recorded against the incident ticket...