Does your organization have a documented incident escalation procedure that defines coordination with both internal stakeholders (e.g., management, legal) and external parties (e.g., customers, regulators, law enforcement)?

This question assesses whether your organization has established clear pathways for escalating security incidents to appropriate stakeholders based on severity, impact, and regulatory requirements. Effective incident escalation procedures ensure timely notification to decision-makers, technical teams, legal counsel, affected customers, and regulatory bodies when necessary, preventing communication breakdowns during critical incidents. Evidence could include an incident response plan document that contains escalation matrices, contact information for stakeholders, criteria for different escalation levels, communication templates, and defined timelines for notifications. This document should clearly show when and how incidents are elevated to senior management, legal teams, customers, regulators, or law enforcement.