Skip to main content

Security Escalation Procedures (ST-211)

Overview​

This document defines escalation procedures for security incidents, ensuring appropriate response based on severity and ensuring critical issues receive immediate attention.

Escalation Principles​

  1. Severity-Based: Escalate based on incident severity
  2. Time-Based: Escalate if response time exceeded
  3. Authority-Based: Escalate when decision authority needed
  4. Resource-Based: Escalate when additional resources needed

Escalation Levels​

Level 1: On-Call Engineer → Incident Commander​

Triggers:

  • Any security incident detected
  • Automated security alert received
  • Security vulnerability reported
  • Suspicious activity detected

Actions:

  1. On-Call Engineer receives alert/report
  2. Performs initial triage
  3. Classifies severity
  4. Notifies Incident Commander
  5. Implements immediate mitigations (if needed)

Timeframe: Immediate for Critical/High, within 4 hours for Medium/Low

Level 2: Incident Commander → CTO / Security Lead​

Triggers:

  • Critical (P0) incidents
  • High (P1) incidents requiring executive decision
  • Incidents affecting multiple systems
  • Incidents requiring external resources
  • Response time exceeded

Actions:

  1. Incident Commander notifies CTO/Security Lead
  2. Provides incident summary
  3. Requests resources/decisions
  4. Coordinates response

Timeframe: Within 1 hour for Critical, within 4 hours for High

Level 3: CTO → Executive Team / Board​

Triggers:

  • Critical incidents with significant impact
  • Data breaches affecting users
  • Regulatory notification required
  • Public disclosure required
  • Legal implications
  • Business continuity concerns

Actions:

  1. CTO notifies Executive Team
  2. Provides comprehensive incident summary
  3. Requests strategic decisions
  4. Coordinates external communication

Timeframe: Within 4 hours for Critical incidents

Level 4: External Escalation​

Triggers:

  • Legal requirements (law enforcement)
  • Regulatory requirements (GDPR, etc.)
  • Vendor security incidents
  • Third-party compromise

Actions:

  1. Coordinate with Legal team
  2. Contact appropriate authorities
  3. Notify affected parties
  4. Coordinate public disclosure (if needed)

Timeframe: Per legal/regulatory requirements

Escalation Matrix​

SeverityLevel 1Level 2Level 3Level 4
Critical (P0)ImmediateWithin 1 hourWithin 4 hoursAs needed
High (P1)Within 4 hoursWithin 24 hoursAs neededAs needed
Medium (P2)Within 24 hoursAs neededAs neededN/A
Low (P3)Within 7 daysAs neededN/AN/A

Escalation Triggers​

Severity-Based Escalation​

Critical (P0):

  • Automatic escalation to Level 2
  • Immediate notification to CTO
  • Prepare for Level 3 escalation

High (P1):

  • Escalate to Level 2 if:
    • Affects multiple systems
    • Requires executive decision
    • Response time exceeded

Medium/Low (P2/P3):

  • Escalate if response time exceeded
  • Escalate if severity increases

Time-Based Escalation​

Response Time Exceeded:

  • Critical: Escalate if no response within 1 hour
  • High: Escalate if no response within 4 hours
  • Medium: Escalate if no response within 24 hours
  • Low: Escalate if no response within 7 days

Resolution Time Exceeded:

  • Critical: Escalate if not resolved within 48 hours
  • High: Escalate if not resolved within 7 days
  • Medium: Escalate if not resolved within 30 days

Authority-Based Escalation​

Escalate When:

  • Decision authority exceeded
  • Resource allocation needed
  • Policy exception required
  • Strategic decision needed

Resource-Based Escalation​

Escalate When:

  • Additional technical expertise needed
  • External vendor support needed
  • Legal/compliance assistance needed
  • Public relations support needed

Escalation Procedures​

Step 1: Assess Need for Escalation​

  1. Review incident severity
  2. Check response time status
  3. Identify decision/resource needs
  4. Determine appropriate escalation level

Step 2: Prepare Escalation​

  1. Gather incident details
  2. Prepare summary document
  3. Identify required actions
  4. Document current status

Step 3: Execute Escalation​

  1. Contact appropriate level
  2. Provide incident summary
  3. Request specific actions
  4. Document escalation

Step 4: Follow Up​

  1. Confirm escalation received
  2. Track response
  3. Update incident status
  4. Document outcomes

Escalation Communication Template​

Subject: [ESCALATION] Security Incident: [Brief Description]

Incident Summary:
- Severity: [Critical / High / Medium / Low]
- Type: [Data Breach / Vulnerability / Attack / etc.]
- Discovery Time: [Date/Time]
- Current Status: [Active / Contained / Resolved]
- Affected Systems: [List systems]
- Impact: [Description of impact]

Escalation Reason:
- [ ] Severity requires escalation
- [ ] Response time exceeded
- [ ] Decision authority needed
- [ ] Additional resources needed
- [ ] Other: [Description]

Requested Actions:
1. [Action 1]
2. [Action 2]
3. [Action 3]

Current Actions Taken:
- [Action 1]
- [Action 2]

Next Steps:
- [Step 1]
- [Step 2]

Contact Information:
- Escalating: [Name, Role]
- Incident Commander: [Name, Contact]
- On-Call Engineer: [Name, Contact]

Escalation Contacts​

See contacts.md for detailed contact information.

Level 1 Contacts​

Level 2 Contacts​

Level 3 Contacts​

  • Executive Team: Via CTO
  • Board: Via Executive Team

Level 4 Contacts​

Escalation Decision Tree​

Security Incident Detected
    |
    ├─> Critical (P0)?
    |   ├─> Yes → Level 2 (Immediate)
    |   |   └─> Significant Impact?
    |   |       └─> Yes → Level 3 (Within 4 hours)
    |   |           └─> Legal/Regulatory?
    |   |               └─> Yes → Level 4
    |   └─> No → Continue to High
    |
    ├─> High (P1)?
    |   ├─> Yes → Level 1 (Within 4 hours)
    |   |   └─> Multiple Systems / Executive Decision?
    |   |       └─> Yes → Level 2
    |   └─> No → Continue to Medium
    |
    ├─> Medium (P2)?
    |   ├─> Yes → Level 1 (Within 24 hours)
    |   |   └─> Response Time Exceeded?
    |   |       └─> Yes → Level 2
    |   └─> No → Low
    |
    └─> Low (P3)
        └─> Level 1 (Within 7 days)
            └─> Response Time Exceeded?
                └─> Yes → Level 2

De-escalation​

When to De-escalate​

  • Incident severity reduced
  • Incident resolved
  • False positive confirmed
  • Incident contained with no impact

De-escalation Process​

  1. Confirm incident status
  2. Notify escalated contacts
  3. Update incident status
  4. Document de-escalation

Escalation Review​

Regular Review​

  • Frequency: Quarterly
  • Owner: Security Lead
  • Process: Review escalation effectiveness

Review Topics​

  • Escalation timing
  • Communication effectiveness
  • Decision-making speed
  • Resource availability
  • Process improvements

Revision History​

VersionDateAuthorChanges
1.02025-11-08Security TeamInitial escalation procedures