Severity is the degree of harmful impact or consequence associated with an issue or finding. Rating it helps determine how much effort to invest in resolving the problem, especially when some problems are rare, temporary, or easier to tolerate. section 7.2.3 section 14.5.3
Assess severity by asking:
- What would happen if the problem or failure occurred? section 7.2.3 section 14.5.3
- Would the impact threaten operations, require days to restore service, or demand investment in business continuity? section 14.5.3
- Is the issue recurring, client-specific, seasonal, or associated with the same people? section 7.2.3
- Can the organization reasonably tolerate the problem because it is short term or rare? section 7.2.3
A high-severity operational finding
A database failure, including power loss, could stop the company from functioning and take days to restore. The finding therefore belongs near the top of a consequence-ordered summary and may justify investment in an acceptable business-continuity solution. section 14.5.3






