Skip to content
Find out how we support MDR.

Incident severity levels

In order for Sophos Support to prioritize Incidents effectively, Sophos customers or partners should request a Severity Level for each submitted Incident according to the levels detailed below.

Definition of Severity Levels

  • Critical

    A problem related to a Licensed Product that causes a complete loss of a mission critical service in a live or production environment; work cannot continue at all or there is a critical impact to business operations. No acceptable workaround to the problem exists.

  • High

    A High Severity is assigned to an Incident that is causing a significant loss of service and no workaround is available. The problem adversely impacts the business, but operation can continue in a restricted fashion or be alternatively routed.

  • Medium

    A Medium Severity is assigned to an Incident that is causing no loss, or only very minor loss in service. The impact is an inconvenience, which does not impede operation or business. All Incidents initiated by email will be assigned Medium Severity in the first instance, except those of a Low Severity level.

  • Low

    A Low Severity is assigned to a question concerning the operation of a Sophos product, or a suggested change to a product or to the product documentation.


Sophos requires that all Critical and High Severity Level Incidents be submitted via telephone rather than via email or the web in order to facilitate the timeliest response. The initial response from Sophos Support to a Critical Severity Level Incident will normally be by telephone. Subsequent correspondence may be by one or a combination of the above communication methods.

Severity Level Assignment

All Incidents submitted by a customer or a partner will be assigned a Severity Level at the discretion of Sophos Support; taking into account the requested level in accordance with Definition of Severity Levels and the information provided by the customer or partner regarding the Incident.

In the event that a requested Severity Level is not indicated by the customer or partner with the submitted Incident, Sophos Support will assign the Incident a Severity Level of “Medium” or “Low”, as detailed in Definition of Severity Levels.

Multiple Support Incidents

In the event that an Incident addresses several separate problems, Sophos Support will separate each problem into independent Incidents and classify such Incidents according to the Severity Levels detailed in Definition of Severity Levels.

Severity Level Reassignment

Customers or partners who encounter a problem with the Products which is identical to an Incident previously submitted and resolved, must submit a new Incident to be registered. The recurrence of the Incident will again be prioritized according to the Severity Levels detailed in the section Definition of Severity Levels above. In the event that a submitted Incident with the Products worsens, customers or partners may request that such Incident be reclassified with a higher Severity Level.