Response Matrix Criticality Level 1 Initial Response Times* Notes 60 minutes CL1 Criticality Level 2 Reporting not required Employee investigations that are time sensitive should typically be classified at this level. Reporting not required May include: CL2 Criticality Level 3 CL3 Incident or employee investigations that are not time sensitive. Long-term investigations involving extensive research. *Initial Response Time – This specifies the maximum amount of time that should elapse before an Agency notifies Q-CERT. 57 NATIONAL INFORMATION ASSURANCE MANUAL