Escalation procedure

Escalation has two dimensions that ITIL and most incident-response frameworks separate. Functional (horizontal) escalation moves an alert or incident to people with more specialised skills, for example from a SOC tier 1 analyst to tier 2 or 3, to the network team or to an external incident response retainer. Hierarchical (vertical) escalation moves it to people with more authority, such as the security manager, the CIO, the crisis team or the board, because a decision is needed that the current handler is not mandated to take. Most procedures combine both and trigger them independently.

Triggers are defined as a severity matrix, typically four or five levels (SEV1 to SEV4 or P1 to P4), with objective criteria such as affected systems and their criticality, number of users or customers affected, confirmed or suspected involvement of personal data, evidence of an active attacker, lateral movement or privileged-account compromise, and media or regulator attention. Each level maps to who must be informed, within what time, over which channel, and who has decision authority. Time-based escalation is equally important: if an incident at a given severity is not acknowledged within, say, 15 minutes or not contained within a set period, it escalates automatically. On-call tooling implements this as escalation policies that page the next person in the chain.

Regulatory thresholds belong in the matrix. Under NIS2 Article 23(3) an incident is significant if it has caused or is capable of causing severe operational disruption or financial loss, or has affected or can affect others by causing considerable material or non-material damage, and Commission Implementing Regulation (EU) 2024/2690 sets quantitative thresholds for digital infrastructure and digital service providers. Because the 24-hour early warning runs from awareness of a significant incident, the procedure must route candidate incidents quickly to whoever assesses significance. Likewise, any incident that may involve personal data should be escalated to the data protection function immediately, since the GDPR 72-hour clock under Article 33 runs in parallel.

Common failures are procedures that name roles but not people or deputies, contact details stored only in systems affected by the incident, escalation that depends on the first responder's courage to wake a director at night, and severity levels defined so vaguely that everything is either critical or ignored. De-escalation criteria and a record of every escalation decision with timestamp are also part of the procedure, as they feed the incident report and the lessons-learned review.