thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Foundational

Escalation

Transferring an alert or incident to a higher tier, specialist team or management according to defined criteria.

Definition

Escalation procedures specify thresholds (severity, asset type, data involved), contacts and timeframes. Functional escalation moves work to more skilled teams, while hierarchical escalation informs management. Clear escalation paths are part of the incident response plan.

Example

A Tier 1 analyst escalates a domain controller compromise to the IR lead and CISO.

Exam tip

Escalation matrices and communication plans are standard parts of an IR plan.

Related terms