Colin Farrell works as a senior cloud security engineer in a healthcare company. His organization has migrated all workloads and data in a private…

According to incident impact scales such as NIST SP 800-61 r2, a “High” severity incident is one that seriously degrades or interrupts mission-critical services, significantly affecting the organization’s customers or operations. In this scenario, critical services became unavailable to a group of users despite successful detection. The loss of availability of critical (mission-essential) services elevates the incident to the High category because it causes substantial business impact that requires immediate response.

B. An outage of critical services is not “None”.
C. Low is for limited or non-critical impact, which does not apply.
D. Medium covers moderate impact; disruption of critical services exceeds this threshold.

1. NIST SP 800-61 Revision 2, §2.3.2 “Incident Impact”, Table 3-1 (page 2-7): High = severe mission impact/critical service outage. https://doi.org/10.6028/NIST.SP.800-61r2

2. SANS Institute Reading Room, “Incident Severity Classification” §High Severity – mission-critical service disruption, para 1.