Threat levels indicate the level of risk to your organization cyberattacks.
A low risk level (green) means that there is no unusual activity or elevated concern for viruses, hacking, or malicious activities.
A guarded risk level (often colored blue) means that there is a general risk for potential viruses, hacking, and malicious activities. No known exploits have been identified or no significant impact has occurred. There may be a new virus or credible warnings about a threat but as yet there has been no impact. When a blue level is reached, vulnerable systems must be identified and appropriate countermeasures put into place.
An elevated (yellow) risk level indicates a significant risk due to a virus, hacking, or other malicious activity that may compromise systems or diminish services that are not necessarily critical. There are known vulnerabilities being exploited and/or a high potential for significant disruption or damage. At this level, monitoring of systems should be increased and countermeasures should be implemented immediately.
A high (orange) risk level indicates that there is a high risk of virus, hacking, or other malicious activity that may compromise core infrastructure and multiple critical systems, or infrastructure. When this level is reached, security mechanisms should be monitored closely and you may need to consider limiting or shutting down any connections to external networks that are not critical. It may even be wise to use alternative methods of communication rather than electronic.
A severe or red threat level indicates a severe risk for a virus, hacking, or other malicious activity that may result in widespread outages and or compromise systems significantly, debilitating critical infrastructure. Targets at this level are core services such as critical routers, VPNs, firewalls, IDS systems, authentication servers, or DNS servers. There may be no known remedy to attacks on this level. If you reach this threat level, you will need to shut down all connections until the issues have been corrected and isolate internal networks to limit or contain the disruption or damage.