How severe is this incident and what response does it need?

How severe is this incident and what response does it need?

Decision tree

Overview

Type
Decision tree
Entry
Q1
Questions
6
Outcomes
5
Author
Andrew
Last updated
2026-05-12

Full decision path

Start: Q1

Q1 — Are production systems currently down or inaccessible?

Q2 — Is data loss or a security breach involved?

Q3 — Is the incident degrading performance for a significant number of users?

Q4 — Has the incident lasted more than 30 minutes?

Q5 — Is this a single-user or cosmetic issue?

Q6 — Could this issue escalate if left unresolved?

Outcomes

P0 — Critical (OUT_P0)
Reached from Q2 (yes).
P1 — High (OUT_P1)
Reached from Q2 (no).
P2 — Medium (OUT_P2)
Reached from Q4 (yes).
P3 — Low (OUT_P3)
Reached from Q4 (no), Q6 (yes).
P4 — Informational (OUT_P4)
Reached from Q5 (yes), Q6 (no).

Machine-Readable JSON (Canonical Model)

View JSON
{
  "_meta": {
    "schema": "https://www.drawdecisiontree.com/decision-dag.schema.json",
    "source": "https://www.drawdecisiontree.com",
    "description": "DrawDecisionTree.com is a free tool for building, sharing, and embedding interactive decision trees. This file is the machine-readable export of a published decision tree. The `dsl` field contains the original source in the Decision DAG DSL; the `dag` schema is documented at the URL in `schema` above.",
    "links": {
      "interactive": "https://www.drawdecisiontree.com/trees/drawdecisiontree/incident-severity",
      "embed": "https://www.drawdecisiontree.com/embed/path/drawdecisiontree/incident-severity",
      "dsl_reference": "https://www.drawdecisiontree.com/decision-tree-dsl-reference",
      "guides": "https://www.drawdecisiontree.com/guides",
      "schema_docs": "https://www.drawdecisiontree.com/decision-dag.schema.json",
      "author_trees": "https://www.drawdecisiontree.com/trees/drawdecisiontree"
    },
    "generated_at": "2026-07-03T21:08:41.962Z"
  },
  "author": {
    "handle": "drawdecisiontree",
    "first_name": "Andrew",
    "last_name": null,
    "avatar_url": "1d32d828-b6ca-40ec-bdd7-771fe7b9c36a/avatar-1778531481027.svg",
    "display_name": "Andrew"
  },
  "file": {
    "id": "1dddcd00-2300-4f44-881f-c5efe2deae45",
    "name": "How severe is this incident and what response does it need?",
    "public_slug": "incident-severity",
    "updated_at": "2026-05-12T16:53:43.587978+00:00",
    "url": "https://www.drawdecisiontree.com/trees/drawdecisiontree/incident-severity",
    "json_url": "https://www.drawdecisiontree.com/trees/drawdecisiontree/incident-severity/tree.json",
    "dsl_url": "https://www.drawdecisiontree.com/trees/drawdecisiontree/incident-severity/tree.dag"
  },
  "meta": {
    "description": null,
    "mode": "decision",
    "entry": "Q1",
    "tags": [],
    "image": null
  },
  "questions": [
    {
      "id": "Q1",
      "text": "Are production systems currently down or inaccessible?"
    },
    {
      "id": "Q2",
      "text": "Is data loss or a security breach involved?"
    },
    {
      "id": "Q3",
      "text": "Is the incident degrading performance for a significant number of users?"
    },
    {
      "id": "Q4",
      "text": "Has the incident lasted more than 30 minutes?"
    },
    {
      "id": "Q5",
      "text": "Is this a single-user or cosmetic issue?"
    },
    {
      "id": "Q6",
      "text": "Could this issue escalate if left unresolved?"
    }
  ],
  "outcomes": [
    {
      "id": "OUT_P0",
      "label": "P0 — Critical"
    },
    {
      "id": "OUT_P1",
      "label": "P1 — High"
    },
    {
      "id": "OUT_P2",
      "label": "P2 — Medium"
    },
    {
      "id": "OUT_P3",
      "label": "P3 — Low"
    },
    {
      "id": "OUT_P4",
      "label": "P4 — Informational"
    }
  ],
  "dsl": "dag: How severe is this incident and what response does it need?\nversion: 1.0.0\nentry: Q1\n\nQ1: Are production systems currently down or inaccessible?\n  hint: \"Down\" means users cannot complete core workflows.\n  yes -> Q2\n  no  -> Q3\n\nQ2: Is data loss or a security breach involved?\n  yes -> [OUT_P0]\n  no  -> [OUT_P1]\n\nQ3: Is the incident degrading performance for a significant number of users?\n  yes -> Q4\n  no  -> Q5\n\nQ4: Has the incident lasted more than 30 minutes?\n  yes -> [OUT_P2]\n  no  -> [OUT_P3]\n\nQ5: Is this a single-user or cosmetic issue?\n  yes -> [OUT_P4]\n  no  -> Q6\n\nQ6: Could this issue escalate if left unresolved?\n  yes -> [OUT_P3]\n  no  -> [OUT_P4]\n\n[OUT_P0]: P0 — Critical\n  description: Full outage or data/security incident. Page on-call immediately. War room within 15 min.\n  code: SEV_P0\n\n[OUT_P1]: P1 — High\n  description: Major functionality down, no data loss. Notify on-call. Response within 30 min.\n  code: SEV_P1\n\n[OUT_P2]: P2 — Medium\n  description: Degraded performance affecting many users. Assign to team lead. Resolve within 4 hours.\n  code: SEV_P2\n\n[OUT_P3]: P3 — Low\n  description: Minor issue with potential to grow. Log and schedule for next sprint.\n  code: SEV_P3\n\n[OUT_P4]: P4 — Informational\n  description: Cosmetic or single-user issue. Add to backlog for routine triage.\n  code: SEV_P4\n"
}

DSL Representation

dag: How severe is this incident and what response does it need?
version: 1.0.0
entry: Q1

Q1: Are production systems currently down or inaccessible?
  hint: "Down" means users cannot complete core workflows.
  yes -> Q2
  no  -> Q3

Q2: Is data loss or a security breach involved?
  yes -> [OUT_P0]
  no  -> [OUT_P1]

Q3: Is the incident degrading performance for a significant number of users?
  yes -> Q4
  no  -> Q5

Q4: Has the incident lasted more than 30 minutes?
  yes -> [OUT_P2]
  no  -> [OUT_P3]

Q5: Is this a single-user or cosmetic issue?
  yes -> [OUT_P4]
  no  -> Q6

Q6: Could this issue escalate if left unresolved?
  yes -> [OUT_P3]
  no  -> [OUT_P4]

[OUT_P0]: P0 — Critical
  description: Full outage or data/security incident. Page on-call immediately. War room within 15 min.
  code: SEV_P0

[OUT_P1]: P1 — High
  description: Major functionality down, no data loss. Notify on-call. Response within 30 min.
  code: SEV_P1

[OUT_P2]: P2 — Medium
  description: Degraded performance affecting many users. Assign to team lead. Resolve within 4 hours.
  code: SEV_P2

[OUT_P3]: P3 — Low
  description: Minor issue with potential to grow. Log and schedule for next sprint.
  code: SEV_P3

[OUT_P4]: P4 — Informational
  description: Cosmetic or single-user issue. Add to backlog for routine triage.
  code: SEV_P4

Machine Access

Questions in this decision tree

Possible outcomes

How to use this decision tree

Click "Open interactive version" to step through the questions. Your answers narrow the tree until a recommended outcome is reached. You can also embed this tree on your own site.

More decision trees by Andrew

Which API design pattern is right for my project?
Which API design pattern is right for my project?
Determine the right API design style for your integration scenario.
CI/CD Pipeline Tool Selection
CI/CD Pipeline Tool Selection
Choosing a CI/CD platform is a long-term infrastructure commitment — pipelines accumulate config, custom scripts, and team muscle memory that make switching painful. This tree eliminates tools that don't fit your source control host, infrastructure model, or team scale, leaving only the options genuinely viable for your situation.
Which cloud provider should I use — AWS, Azure, or Google Cloud?
Which cloud provider should I use — AWS, Azure, or Google Cloud?
Answer a few questions to identify the most suitable cloud platform for your workload.
Container Orchestration Platform Selection
Container Orchestration Platform Selection
Container orchestration is foundational infrastructure — the platform you choose shapes how you deploy, scale, network, and operate every service you run. This tree eliminates options that don't match your operational maturity, cloud provider commitment, and workload complexity, so you land on the platform that fits your team today without over-engineering for a scale you haven't reached.
How do I assess the health of a customer account?
How do I assess the health of a customer account?
Classify a customer's health score to guide proactive engagement and retention strategy. Use this tree during your regular account reviews or whenever a trigger event—such as a low NPS, a support spike, or a missed check-in—prompts a reassessment. The outcome drives the cadence and urgency of your next CSM action.
How should I escalate this customer issue?
How should I escalate this customer issue?
Determine the appropriate escalation path when a customer issue exceeds normal CSM handling. This tree helps you move quickly and confidently when a situation is deteriorating, ensuring the right people are engaged at the right time. Use it the moment you sense an issue may outgrow your ability to resolve it alone.