This document describes a method for classification of requirements based on severity and susceptibility. This classification method needs a system in line with the framework described in ISO 24096-1 to form a complete system. This document indicates the needed elements for a consistent evaluation of the severity over time, and supports a company business model and its brand image; gives background to why more than severity is useful as a base for classification; adds susceptibility as a viable parameter along with severity; describes the methodology for classification requirements using severity and susceptibility.