Annex E

Severity Scale

FIRE uses a six-point standardised severity scale. Severity must be reported at every phase. The step-change transition statements indicate the threshold between adjacent levels.

Severity vs impact. Severity is a holistic assessement of the incident's overall effect on the entity. The four separate impact dimensions (financial, operational, reputational, external — Annexes J–M) inform but do not mechanically determine the overall severity rating.
Level Description
Nil No observed or expected impact. The incident had no material effect on the entity's operations, services, data, or stakeholders. May include events investigated and found to be benign.
▼ At least some impact is identified or expected
Negligible Very limited impact; easily absorbed within normal operations. No customer impact, no media attention, no financial loss, and no regulatory notification required. Business continues as usual.
▼ Some customer impact or limited media coverage begins, or a regulatory notification threshold is approached
Low Limited impact that is manageable within existing capabilities. Minimal customer impact, limited or localised media attention, minor financial loss, and potentially some regulatory notification required at the local level.
▼ Impact becomes material, regulatory notification is triggered, and active management is required
Medium Moderate impact requiring active management. Noticeable customer disruption, some media coverage, moderate financial loss, and regulatory notification is required. Internal incident management escalated.
▼ Impact is widespread, material financial loss is incurred, and significant regulatory scrutiny follows
High Significant impact with widespread effects. Substantial customer disruption, significant media attention, material financial loss, and mandatory regulatory notification with heightened regulatory scrutiny. Senior management involved.
▼ Systemic risk emerges, critical market infrastructure is affected, or multiple institutions are impacted
Extreme Severe, potentially systemic impact. Critical failure or disruption affecting multiple institutions, critical market infrastructure, or the broader financial system. Potential for systemic risk or contagion. Immediate regulatory intervention likely.

See also: Impact Scales (Annexes J–M) — the four-dimensional impact assessment that feeds into severity rating.