Three tiers
A five-level severity scale fails because its middle levels carry no decision — a finding marked Medium tells an engineer nothing about when to fix it or whether it may be deferred. Three tiers is the smallest number that captures genuinely different organizational responses.
Each tier maps to a different deadline, a different owner, and a different budget. That is what makes a tier an instruction rather than a label.
Critical
Stop active bleeding
Could an external attacker use this to gain access, escalate privilege, or take data — today, without an insider and without a chain of unlikely events?
Tier 1 covers conditions an attacker can act on now. The defining property is not severity score but reachability: the vulnerability is exposed to an untrusted network, exploitation is understood and tooled, and success grants meaningful access. These are the findings that show up in breach post-mortems.
Regulatory
Maintain the license to operate
Would a named auditor, regulator, or contractual counterparty record this as a deficiency?
Tier 2 covers conditions that threaten certification, contract, or regulatory standing. The consequence is not a breach but a finding in someone else's report: a qualified SOC 2 opinion, a failed PCI DSS assessment, a GDPR Article 32 exposure. These are deadline-driven rather than threat-driven, and the deadline belongs to the auditor.
Best Practices
Reduce the rate at which the first two tiers refill
Does fixing this reduce the number or severity of future Tier 1 and Tier 2 findings?
Tier 3 covers structural improvements with compounding returns. Nothing here is urgent in isolation, which is exactly why it never gets done without a tier of its own. Tier 3 is the only tier where deferral is a legitimate, recorded outcome — an organization that closes every Tier 3 item is probably under-investing elsewhere.
What each tier commits you to
Copy this into your policy document and adjust. An SLA your organization will actually meet beats a stricter one it will not.
| Tier | Deadline | Escalation | Budgeted from |
|---|---|---|---|
| Tier 1 · Critical | 24–72 hours | CISO and executive sponsor notified at 48 hours | Unplanned work — Tier 1 pre-empts sprint commitments |
| Tier 2 · Regulatory | 30 days | Security manager review at 14 days | Planned work — scheduled against the audit calendar |
| Tier 3 · Best Practices | 90 days | Reviewed at quarterly planning; may be formally deferred | Planned work — a standing percentage of engineering capacity |
Four domains
Tier answers when it must be fixed. Domain answers who fixes it.
Network
NETWhat can be reached, and from where?
Network engineering / cloud platform
Identity & Access Management
IAMWho can act, and how strongly is that proven?
Identity engineering / IT operations
Data Protection
DATWhat happens to the data if everything else fails?
Data platform / application engineering
Processing Protection
PRCIs the compute that runs the business trustworthy and available?
Platform engineering / SRE
Assigning a tier
Four questions, asked in a fixed order. The order is what makes two analysts reach the same tier for the same finding — and all 36 catalog entries record the reasoning behind their own assignment.