<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: building-incident-escalation-procedures
description: >-
  Design and implement tiered incident escalation procedures with defined
  SLA timers, decision trees, role-based routing, and automated escalation
  triggers to ensure incidents reach the right responders within target timeframes.
domain: cybersecurity
subdomain: incident-management
tags:
  - escalation
  - sla
  - routing
  - decision-tree
  - on-call
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["TA0001", "TA0040"]
  nist-csf: ["RS.CO-1", "RS.RP-1"]
  frameworks: ["NIST SP 800-61", "ITIL Incident Management"]
---

# Building Incident Escalation Procedures

## Overview

Escalation procedures define how incidents move between response tiers based
on severity, elapsed time, and scope changes. Effective escalation reduces
MTTR by routing incidents to the right expertise level without delays.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Severity matrix | Escalation trigger thresholds |
| On-call rotation (PagerDuty/Opsgenie) | Automated paging |
| Ticketing system | Escalation state tracking |
| Contact directory | Role-based routing |

## Escalation Tiers

```
TIER 1 — SOC Analyst (0–15 min)
├── Initial triage and classification
├── Severity assignment using matrix
├── Auto-escalate S1 immediately
└── Escalate S2 within 15 min if unresolved

TIER 2 — Incident Lead (15–60 min)
├── Assume incident command
├── Validate severity and scope
├── Activate war room for S1/S2
└── Coordinate containment actions

TIER 3 — CISO / VP Security (as needed)
├── Strategic decisions (disclosure, legal)
├── Resource allocation, vendor engagement
└── Executive communication

EXTERNAL — Third Party (as needed)
├── DFIR retainer activation
├── Law enforcement notification
└── Legal counsel engagement
```

## SLA Timers

| Severity | First Response | Escalation T2 | Escalation T3 | Containment |
|----------|---------------|----------------|----------------|-------------|
| S1 | 5 min | Immediate | 30 min | 1 hr |
| S2 | 15 min | 30 min | 2 hr | 4 hr |
| S3 | 1 hr | 4 hr | N/A | 24 hr |
| S4 | 4 hr | 24 hr | N/A | 72 hr |

## Decision Tree

```
START: New incident declared
│
├─ S1 (Critical)? → Page T2+T3 immediately → War room
├─ S2 (High)? → Page T2 within 15 min → Prepare war room
├─ Scope expanding? → Re-evaluate severity → Escalate if upgraded
├─ SLA at risk? → Auto-escalate to next tier
└─ LOOP every 15 min: Re-evaluate scope and severity
```

## PagerDuty Integration

```bash
curl -X POST https://events.pagerduty.com/v2/enqueue \
  -H "Content-Type: application/json" \
  -d '{
    "routing_key": "YOUR_INTEGRATION_KEY",
    "event_action": "trigger",
    "payload": {
      "summary": "S1 Incident: Active ransomware deployment",
      "severity": "critical",
      "source": "incident-management",
      "custom_details": {
        "incident_id": "INC-2026-0142",
        "category": "CAT-3"
      }
    }
  }'
```

## Workflow

Follow the structured procedure outlined in Key Concepts above.

## Verification

- [ ] Escalation tiers documented with clear criteria
- [ ] SLA timers configured in ticketing system
- [ ] PagerDuty/Opsgenie policies match escalation tiers
- [ ] Decision tree tested via tabletop exercise
- [ ] Auto-escalation triggers functional for SLA breaches
