Sev1
Critical business process down with no workable workaround, or a broad outage of a core service.
Public sample
This page shows the shape of an environment assessment deliverable. Bracketed fields are placeholders for a real engagement. Final findings and service targets are developed for your environment.
Lean inventory of in-scope systems. Access verification records named custodians only — no passwords, MFA codes, or secrets are collected on this worksheet.
| System / app | Tech admin | Business owner | Criticality | Key dependencies |
|---|---|---|---|---|
| [e.g. Illustrative — Identity / email] | [Name / role] | [Name / role] | [Critical] | [Identity · network · upstream] |
| [e.g. Illustrative — Line-of-business app] | [Name / role] | [Name / role] | [Important] | [Depends on…] |
| [System name] | [Name / role] | [Name / role] | [Standard] | [Dependencies] |
| [System name] | [Name / role] | [Name / role] | [Convenience] | [Dependencies] |
Suggested criticality labels (confirm during assessment): Critical · Important · Standard · Convenience.
| Priority | Finding | Affected systems / process | Suggested next step |
|---|---|---|---|
| P1 | [Finding title] | [System / process] | [Stabilize / project / vendor] |
| P2 | [Finding title] | [System / process] | [Stabilize / project / vendor] |
| P3 | [Finding title] | [System / process] | [Stabilize / project / vendor] |
Definitions below are proposed for workshop confirmation. They are a design input — not an active service promise until approved in writing. Numeric acknowledgement, update, and restoration targets stay [TBD / agreed].
Critical business process down with no workable workaround, or a broad outage of a core service.
Material multi-user degradation with only a partial workaround.
Limited user or function impairment; business continues with an acceptable workaround.
Service requests, how-to questions, and planned changes.
| Severity | Coverage hours | Ack / initial response | Update cadence | Workaround / restore | Full resolution |
|---|---|---|---|---|---|
| Sev1 | [TBD / agreed] | [TBD / agreed] | [TBD / agreed] | [TBD / agreed] | [TBD / agreed] |
| Sev2 | [TBD / agreed] | [TBD / agreed] | [TBD / agreed] | [TBD / agreed] | [TBD / agreed] |
| Sev3 | [TBD / agreed] | [TBD / agreed] | [TBD / agreed] | [TBD / agreed] | [TBD / agreed] |
| Sev4 | [TBD / agreed] | [TBD / agreed] | [TBD / agreed] | N/A | [TBD / agreed] |
Business recovery goals — recovery time objective (RTO: how quickly a system should be usable again) and recovery point objective (RPO: how much data loss is acceptable) — are recorded separately from provider response commitments. Security incidents follow an agreed incident-response path. Third-party restore outcomes depend on the upstream vendor.