Your severity matrix is a slide deck until 3am, when it becomes a decision someone makes with their eyes half open. Most small-team matrices fail at 3am because they describe categories ("SEV2: significant impact") instead of answering the two questions actually being asked: who do I wake up, and who do I tell?
Here are the twelve fields that survived contact with real incidents on small teams. Score a page in, print it, tape it to the wall.
1. Impact breadth — how many users hit, one number, estimated. "Some users" is not a number.
2. Revenue path — is checkout, signup, or invoicing among the broken paths? This single bit decides whether you're paging anyone at all.
3. Data exposure — is customer data leaving? PII, payment data, or credentials exposed jumps you to the top regardless of user count.
4. Customer tier — your largest customer's name, pre-agreed. Decide now what level of incident earns them a phone call, not an email.
5. Reversibility — can you roll back in under 10 minutes without losing data? "Reversible" incidents get one engineer; "not reversible" get the IC.
6. On-call load — who is actually awake right now? A matrix that assumes two responders when you have one person conscious is decoration.
7. Escalation trigger — the exact condition that moves this up a level: X minutes without a mitigation path, or Y failed rollbacks.
8. Comms channel — where the updates go (named Slack channel, named status page), so the first responder doesn't invent one under pressure.
9. Exec briefing threshold — the level at which leadership hears within 30 minutes. Below it, they read the postmortem like adults.
10. Legal/notification trigger — does this breach a notification duty (GDPR/72h, card brands, contracts)? A yes/no field with a link to the actual rulebook.
11. ETA-to-mitigation — your best honest estimate of minutes-to-workaround. Wrong is fine; missing is how incidents stretch.
12. Postmortem trigger — which severities owe a written review within 72h. Make it a short list or nobody will believe it.
The part that makes it real: each severity level ends with exactly two actions — who is paged, and what gets posted publicly. If a level doesn't change those two things, delete it. Three levels beat five, always.
The test: hand the card to the newest team member during a tabletop drill. If they can't call the severity in 60 seconds, the matrix is written for people who already know the answer.
We package the printable version of this — severity matrix plus eleven more field cards — as Ops Field Cards (A$4, print-ready PDF). The coupon LAUNCH50 takes 50% off everything in the full catalog, including the done-for-you runbook service if you'd rather we build it. A free starter set (The First 30 Minutes) costs nothing and covers the first half hour of any incident.
All of the supporting notes — severity matrices, comms timelines, on-call handover cards — are also free to read at ops-notes.
Top comments (0)