SOP
Incident Escalation Matrix
This SOP defines the incident escalation matrix for security incidents. It specifies severity levels, notification paths, timelines, and responsible parties to ensure that every incident is escalated to the right people at the right time. It is a companion document to the Security Incident Response Procedure and the Security Incident Reporting and Escalation Procedure. Those documents govern the full IR lifecycle; this SOP provides a quick-reference escalation guide for the SOC and IR team. Where this SOP and the Security Incident Response Procedure (security/procedure-security-incident-response.md) differ on the severity of an incident, the procedure governs.
- Type
- SOP
- Version
- 1.4.2
- Date
- 2026-10-26
- Owner
- Chief Information Security Officer
- Approving authority
- Chief Information Officer
- Classification
- Public
- Confidentiality
- Public
- Category
- Information Security
- Review frequency
- Annual or following significant organizational or contact change
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- Purpose
- Incident severity levels
- Escalation matrix
- Notification method
- Special escalation triggers
- Out-of-hours escalation
- Escalation review
- Framework alignment
Frameworks it maps to
Related documents
- Security Incident Response Proceduresecurity
- Security Incident Reporting and Escalation Procedureresilience
- Data Protection and Privacy Breach Response Procedureprivacy
- Business Continuity and Crisis Management Planresilience
- IT Service Management Frameworkoperations
Next
All Documents