Escalation Path
Definition
The predefined chain of notification and decision-making authority that an incident follows as its severity increases. Documented in the IR plan before any incident occurs, it specifies who must be informed at each severity level, what actions they are authorised to take, and at what point external notification to regulators or affected parties is required.
- When defined
- Before any incident occurs, in the IR plan
- Specifies
- Who is informed at each severity level
- Also covers
- Actions each role is authorised to take
- Triggers
- External notification to regulators or affected parties
Common questions
Why does the escalation path need to be fixed before an incident, not decided during one?+
Deciding notification authority in the moment wastes response time and risks missing statutory deadlines, such as breach notification windows, so the chain of who decides and who is told is agreed and documented in advance.
How does an escalation path interact with regulatory notification deadlines?+
It maps severity thresholds to the point at which legal or compliance sign-off is required, so a qualifying incident automatically reaches the people responsible for meeting notification deadlines without waiting for ad hoc escalation.
Related terms
- CSIRT (Computer Security Incident Response Team)
- A dedicated team responsible for coordinating the response to confirmed security incidents. The CSIRT manages containment, forensic investigation, communication to stakeholders, and...
- Indicator of Compromise (IoC)
- An observable artefact that suggests a system has been involved in a malicious event. Static analysis produces file-based IoCs: cryptographic hashes, embedded...
- Managed Security Service Provider (MSSP)
- A third-party organisation that delivers security monitoring, tooling, and analyst coverage as a contracted service. Used in fully outsourced and co-managed SOC...
- Playbook
- A documented step-by-step procedure for responding to a specific type of security event. Playbooks standardise analyst behaviour, reduce response time, and ensure...
- Security Operations Centre (SOC)
- The dedicated team and technology platform responsible for continuous monitoring, detection, analysis, and coordinated response to security events. May be in-house, co-managed,...
- SIEM (Security Information and Event Management)
- A platform that aggregates log and event data from systems, networks, and applications across an environment, correlates events against detection rules, generates...
- SOC (Security Operations Centre)
- A function providing continuous monitoring, alert triage, and early detection of security events. The SOC is the first tier of response: it...
- Tactics, Techniques, and Procedures (TTPs)
- A three-level description of adversary behaviour. Tactics are the high-level goals (initial access, persistence, exfiltration). Techniques are the specific methods (spear-phishing, pass-the-hash)....
- Threat Actor
- An individual or group responsible for a security incident or malicious campaign. Threat actors are categorised by motivation (financial, espionage, hacktivism, destruction)...
- Threat Hunting
- A proactive, human-led process that searches for evidence of adversary activity in an environment under the assumption that automated controls have been...
Explained in these topics
- Key Terms and Stakeholders in Incident Response
- SOC Structure and the Tier ModelThe defined procedure by which an alert or incident is passed from one SOC tier to the next, including the information that must accompany the handoff and the...