How to classify a finding
Four questions. Apply them in order and stop at the first that returns yes. The order is the method — it is what makes two different analysts reach the same tier for the same finding.
This procedure works on any finding from any source: a scanner result, a penetration test observation, an architecture review note, or something a colleague mentioned in passing. It does not require a CVE, a CVSS score, or a specific tool.
Is it reachable by an untrusted party right now?
Not in theory, and not after a chain of preconditions — right now, from where an attacker actually stands. A vulnerability on a host that nothing can route to is a different problem from the same vulnerability on a public address. This question is first because it eliminates the majority of the backlog, and because it is objectively testable rather than a matter of judgement.
Does exploiting it grant access, privilege, or data without an unlikely chain of events?
A single step with a known technique, not a five-stage theoretical path. Reading an open storage bucket qualifies. A race condition requiring local access and precise timing does not. If confirmed exploitation exists in the wild — the CISA KEV catalog is the authority — the answer is yes by definition.
Would a named auditor, regulator, or contractual counterparty record it as a deficiency?
Named, not hypothetical. If you can point to the framework and the control — PCI DSS 8.3.6, ISO 27001 A.5.18, SOC 2 CC6.2 — the answer is yes. If the answer is 'a strict auditor might', it is not Tier 2. The distinguishing consequence is a finding in someone else's report, with a deadline that belongs to them.
Does fixing it reduce the number or severity of future Tier 1 and Tier 2 findings?
This is the compounding test. Infrastructure-as-code policy gates prevent the entire class of public-storage findings; role refinement reduces what any future credential theft yields. If the answer is no — the work has no preventive effect and no compliance driver — it is not a security finding, and recording it as one dilutes the queue.
Why the order cannot be changed
Reachability comes first because it is objectively testable and because it eliminates most of the backlog immediately. Compliance comes third because a control obligation says nothing about urgency — a great deal of mandated work is genuinely not urgent, and a small amount of unmandated work genuinely is. Teams that reverse these two end up with an emergency queue full of audit items and real exposures sitting on a 30-day clock.
The procedure applied to six real findings
Each of these is a case where the intuitive answer and the correct answer differ.
CVSS 9.8 remote code execution in a library used by an internal-only batch job with no network listener
- Q1 — reachable by an untrusted party? No. Nothing routes to it.
- Q3 — would an auditor cite it? Yes: unpatched critical vulnerabilities breach the vulnerability-management requirement.
The 9.8 is doing no work here. Score describes the vulnerability; reachability describes your exposure.
CVSS 6.5 vulnerability in an internet-facing edge appliance, listed in the CISA KEV catalog
- Q1 — reachable? Yes, it is the edge.
- Q2 — exploitation without an unlikely chain? Yes: KEV membership means confirmed exploitation in the wild.
A mid-range score outranks a 9.8 because someone is actually using this one. Observed exploitation beats modelled severity.
S3 bucket with public read enabled, containing only marketing images
- Q1 — reachable? Yes, anonymously from the internet.
- Q2 — grants data without a chain? Yes, by definition — reading is the exploit.
Classify by what the permissions allow, not by an inventory of current contents. If write access is also open, the bucket is a distribution point trading on your domain's reputation.
Password policy sets a 10-character minimum where PCI DSS v4.0 requires 12
- Q1 — reachable? Not in the sense meant: no attacker acts on the policy itself.
- Q3 — would an auditor cite it? Yes, PCI DSS 8.3.6, and it is objectively verifiable from a configuration export.
Authentication-related does not mean Tier 1. Missing MFA on privileged accounts is Tier 1; a policy shortfall on the general population is a compliance deficiency.
Terraform pipeline has no policy gate blocking public storage buckets
- Q1 — reachable? No, the pipeline is not exposed.
- Q3 — auditor deficiency? Not directly; no framework mandates this specific gate.
- Q4 — reduces future Tier 1 and 2 findings? Yes, decisively — it prevents the public-bucket class entirely.
The highest-leverage Tier 3 work looks unremarkable in a backlog. Its value is measured in the Tier 1 findings that never get created.
Developer group holds permanent AdministratorAccess across production accounts
- Q1 — reachable? Yes: any of those developers is reachable by phishing, which is the access path.
- Q2 — grants privilege without a chain? Yes — one credential yields full administrative control.
No CVE, no scanner severity, and still Tier 1. Standing privilege sets the blast radius of every other compromise.
Six ways classification goes wrong
Every one of these has been observed repeatedly. Most are the result of asking the questions out of order.
Evaluating compliance before reachability
The single most common error, and the reason the questions are ordered. Teams that ask 'is this a compliance issue?' first fill Tier 2 with genuinely urgent exposures and lose the distinction the framework exists to draw.
Treating CVSS as the tier
A 9.8 with no reachability is Tier 2; a 6.5 in the KEV catalog on the edge is Tier 1. Research has repeatedly found that remediating by score alone performs little better than remediating at random.
Downgrading because an environment is labelled non-production
Development databases are routinely seeded with production data and share credentials with production systems. Classify by the data present and the credentials accepted, not by the environment's name.
Downgrading because a service is patched
Patch state does not change an exposure finding. An internet-facing SSH service with current patches and key-based authentication is still Tier 1 until reachability is removed.
Folding a Tier 1 finding into a Tier 3 programme
Exposed pipeline credentials discovered during CI/CD hardening are Tier 1 and need rotating today. Recording them inside the hardening item silently applies a 90-day SLA to a 72-hour problem.
Importing a benchmark report wholesale at one tier
CIS Benchmark output mixes genuine Tier 1 items — public storage, unrestricted ingress — with Tier 3 hygiene. Triage each item; the report's own severity ratings are not tiers.
What each tier actually commits you to
A tier is not a label. It names a deadline, an owner, an escalation path, and a budget the work comes out of.
- Deadline
- 24–72 hours
- Escalation
- CISO and executive sponsor notified at 48 hours
- Owned by
- Security operations, with a named engineering owner per finding
- Budgeted from
- Unplanned work — Tier 1 pre-empts sprint commitments
- Deadline
- 30 days
- Escalation
- Security manager review at 14 days
- Owned by
- Compliance, with engineering executing the remediation
- Budgeted from
- Planned work — scheduled against the audit calendar
- Deadline
- 90 days
- Escalation
- Reviewed at quarterly planning; may be formally deferred
- Owned by
- Platform and engineering teams
- Budgeted from
- Planned work — a standing percentage of engineering capacity
Then assign a domain
Tier sets the deadline; domain sets the owner. Assign the domain of the control that fixes it, not the domain of the symptom.
Network
NETWhat can be reached, and from where?
Typically owned by Network engineering / cloud platform.
Identity & Access Management
IAMWho can act, and how strongly is that proven?
Typically owned by Identity engineering / IT operations.
Data Protection
DATWhat happens to the data if everything else fails?
Typically owned by Data platform / application engineering.
Processing Protection
PRCIs the compute that runs the business trustworthy and available?
Typically owned by Platform engineering / SRE.
Check your answer against the catalog
The 36 catalog entries each record the tier rationale and the mistake teams most often make when classifying that particular finding. If your classification disagrees with the catalog, the entry will usually tell you which of you is wrong.
Browse the catalog