Severity Levels

severity_levels:
  SEV1:
    name: "Critical"
    description: "Complete service outage or data loss affecting all users"
    impact: "All users unable to use the service"
    response_time: "Immediate (within 5 minutes)"
    communication: "Every 15 minutes"
    resolution_target: "30 minutes"
    examples:
      - "Complete API outage"
      - "Data breach confirmed"
      - "Payment processing failure for all users"
      - "Data loss or corruption"

  SEV2:
    name: "Major"
    description: "Significant service degradation affecting many users"
    impact: "Majority of users experiencing errors or severe degradation"
    response_time: "Within 15 minutes"
    communication: "Every 30 minutes"
    resolution_target: "2 hours"
    examples:
      - "Error rate > 10% for specific endpoint"
      - "Latency p99 > 5s for all users"
      - "Authentication service degraded"
      - "Single region outage (multi-region service)"

  SEV3:
    name: "Minor"
    description: "Service degradation affecting some users"
    impact: "Subset of users experiencing issues"
    response_time: "Within 1 hour"
    communication: "Every hour"
    resolution_target: "8 hours"
    examples:
      - "Error rate > 5% for specific endpoint"
      - "Latency p99 > 2s for some users"
      - "Non-critical feature broken"
      - "Single availability zone issue"

  SEV4:
    name: "Low"
    description: "Minor issue with minimal user impact"
    impact: "Few users affected, workaround available"
    response_time: "Within 4 hours"
    communication: "Daily"
    resolution_target: "24 hours"
    examples:
      - "Intermittent errors for < 1% of users"
      - "Minor UI bug"
      - "Documentation error"

impact_severity_map:
  error_rate:
    threshold: "5% for 5 minutes"
    severity: "SEV3"
    escalation: "PagerDuty primary"

    threshold: "10% for 5 minutes"
    severity: "SEV2"
    escalation: "PagerDuty primary + secondary"

    threshold: "50% for 2 minutes"
    severity: "SEV1"
    escalation: "PagerDuty all hands"

  latency:
    threshold: "p99 > 2s for 5 minutes"
    severity: "SEV3"
    escalation: "PagerDuty primary"

    threshold: "p99 > 5s for 5 minutes"
    severity: "SEV2"
    escalation: "PagerDuty primary + secondary"

  availability:
    threshold: "< 99.9% for 15 minutes"
    severity: "SEV3"
    escalation: "PagerDuty primary"

    threshold: "< 99% for 5 minutes"
    severity: "SEV2"
    escalation: "PagerDuty primary + secondary"

    threshold: "< 50% for 2 minutes"
    severity: "SEV1"
    escalation: "PagerDuty all hands"

escalation_triggers:
  time_based:
    - condition: "SEV3 not resolved in 4 hours"
      action: "Escalate to SEV2"
      notify: "SRE manager"

    - condition: "SEV2 not resolved in 2 hours"
      action: "Escalate to SEV1"
      notify: "VP engineering"

  impact_based:
    - condition: "Error rate increasing despite mitigation"
      action: "Increase severity by 1"
      notify: "Incident commander"

    - condition: "Incident spreading to additional services"
      action: "Escalate to SEV1"
      notify: "All engineering leads"

  manual:
    - condition: "IC declares escalation"
      action: "Escalate immediately"
      notify: "Per escalation policy"

executive_notifications:
  triggers:
    - severity: "SEV1"
      timing: "Immediately upon declaration"
      recipients: ["VP Engineering", "CTO"]
      channel: "PagerDuty + Slack DM"

    - severity: "SEV2"
      timing: "Within 30 minutes"
      recipients: ["Director of Engineering"]
      channel: "Slack DM"

    - severity: "SEV1"
      timing: "Every 30 minutes"
      recipients: ["VP Engineering", "CTO"]
      channel: "Email update"

  executive_update_template: |
    **Incident: [Title]**
    Severity: SEV[X]
    Status: [Investigating/Mitigating/Resolved]
    Impact: [Users affected, services affected]
    Duration: [time]
    Next update: [time]

    **What we know:** [brief description]
    **What we're doing:** [current actions]
    **What we need:** [escalation requests, if any]

## Severity Assignment Checklist

### Step 1: Assess Impact
- [ ] How many users are affected?
- [ ] What functionality is broken?
- [ ] Is there data loss or security impact?

### Step 2: Map to Severity
- [ ] Check error rate thresholds
- [ ] Check latency thresholds
- [ ] Check availability thresholds

### Step 3: Assign and Communicate
- [ ] Declare severity to team
- [ ] Set up communication cadence
- [ ] Notify stakeholders per policy

### Step 4: Re-evaluate
- [ ] Reassess severity after 15 minutes
- [ ] Escalate or downgrade as needed
- [ ] Update all communication channels