Every bulletin carries a priority and an exposure level. This page is what they mean. Both come from the Strike48 Incident Response Plan, so the label on a bulletin is a classification against a published standard rather than an adjective.
They answer different questions and are set independently. Priority drives how we respond; exposure describes what was actually reached; residual risk, shown on each bulletin, is what remains for a customer after containment.
Every record is first classified by what it is. The distinction drives the level of response and the reporting obligations, and it can change after review — an event that turns out to threaten data becomes an incident; one that discloses personal or sensitive information becomes a breach.
How urgently do we respond?
Set at triage from service impact and confirmed exposure. It determines who is Incident Commander, when the CISO and Legal are pulled in, and how often leadership is updated. It is about our response, not the customer's risk.
What was actually reached?
The sensitivity and volume of data that was accessed or could have been. A P1 can carry limited exposure and a P2 can carry confirmed exposure — the two do not move together.
What does this mean for you now?
A customer's remaining exposure after containment and the controls that held. Shown with its reasoning on each bulletin, and what decides whether the required customer action is “none” or something specific.
Service disruption, confirmed data exposure, or multiple customers impacted.
Elevated threat with limited exposure, affecting a single customer or internal assets.
A contained or low-impact event.
False positive or negligible impact.
Legal is notified for P1 through P3. The Incident Commander for every priority is recorded on the bulletin, and status transitions are logged in its revision history.
Assigned at triage and revised as the investigation establishes what was reached. The distinction between possible and confirmed is load-bearing: we do not record exposure as confirmed-absent when it was merely not yet investigated, and we do not record it as confirmed-present without evidence.
Residual risk is usually lower than the priority alone would suggest, because something limited the damage. Each bulletin lists those controls and marks each one held, partial, or failed.
Failures are listed alongside the ones that held, on purpose. A list of only the controls that worked is marketing; the failures are where the remediation comes from.
Regulatory clocks begin on confirmation of data exposure, not at closure.