Contact Tree
Definition
A structured list of individuals and teams to notify during an incident, showing the order of contact and the conditions under which each person or group is activated. Also called an escalation tree or call tree. Must be kept current; stale contact trees are a common cause of delayed escalation.
- Field
- Incident escalation procedures
- Also called
- Escalation tree, call tree
- Shows
- Order of contact and activation conditions
- Maintenance need
- Must be kept current
Common questions
Why do stale contact trees cause delayed escalation in real incidents?+
Personnel change roles, phone numbers, and on-call rotations regularly, and a contact tree that is not reviewed against current staffing will route notification to someone who left the team, changed number, or is no longer in the relevant on-call rotation, forcing responders to hunt for the right person during a live incident instead of following the plan.
How does a contact tree differ from a general incident response plan?+
The response plan describes what actions to take and in what sequence during an incident, while the contact tree is narrower: it only maps who gets notified, in what order, and under which trigger conditions, so it can be checked and updated on a much shorter cycle than the full plan.
Related terms
- Escalation Criteria
- The documented conditions that require an analyst to transfer an incident to a higher tier or to external stakeholders. Examples include: severity...
- Handoff Package
- The bundle of information an analyst prepares before transferring an incident to a higher tier. Contents include incident ID, timeline, severity, containment...
- P1/P2/P3/P4 Severity Tiers
- A common four-level severity classification used in SLA structures. P1 (Critical) carries the shortest time windows; P4 (Low) carries the longest. The...
- Service-Level Agreement (SLA)
- A policy or contractual commitment defining how quickly the SOC must perform specific actions (acknowledge, escalate, contain, resolve) for incidents of each...
- SLA Breach
- An instance where a required action was not completed before its SLA timer expired. Each breach is recorded against the incident ticket...