How it's worked out
For a finding from a test, Conform works out the severity from three things:
the control's criticality;
the unit's residual risk;
how far below the line the result was.
The tester can change it, with a reason. A finding raised by hand gets its severity from whoever raises it.
What it decides
Through your Remediation Standards, severity sets:
the fix-by date;
whether an interim action is needed, and how soon;
whether actions must be verified by someone else;
whether proof is expected before an action is done;
how long, if at all, the finding can be accepted instead of fixed.
On the calendar
Fix-by dates appear on the Calendar. A finding turns amber as its date gets close and red once it's overdue.