Domain 4 · Objective reference 4A5 · Chapter 28 of 35
Classify incidents consistently
About 5 minutes · Detailed public baseline effective 2022; the replacement exam starts 3 November 2026 and its exact revised topic/task mapping remains unverified
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: Classify consistently then revise as evidence improves.
Explore the anchors
Record facts and uncertainty.
Concept matching activity
Match this task or description to its concept:
Apply impact and severity criteria.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Management concept and decision mechanism
- Equip teams and define a usable escalation model
Management concept and decision mechanism
Classification describes characteristics such as incident type, affected information or service; categorization and severity help organize handling and priority. Define the terms used by the organization rather than assuming product labels have universal meanings. Severity should consider business impact, scope, urgency, confidence and relevant obligations. An alert may require escalation before every fact is established. Record uncertainty and allow reclassification as evidence changes. A high count of low-impact events should not hide a small number of material incidents affecting a critical service.
Equip teams and define a usable escalation model
Assign primary and alternate incident roles, access to necessary tools, on-call coverage, specialist support, and communication arrangements. Check supplier availability and the ability to use the plan when normal identity or messaging services are unavailable. Training should cover the decisions each role may actually need to make.
Distinguish categorization from priority. Categories help route and analyze incidents; severity or priority reflects the organization's criteria for impact and urgency. Define thresholds, owners, reassessment triggers, and escalation paths. An exercise-specific High label is not a universal legal or industry classification.
Worked example
An unusual export is initially triaged using the affected service and available evidence, then reclassified when its recipient and authorization are established.
Check your understanding
Why should an initial incident category be revisable?
Show explanation
Early information is incomplete; later evidence can change scope, confidence, consequence and the appropriate response.
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.