Does your organization have a documented incident escalation procedure that defines coordination with both internal stakeholders (e.g., management, legal) and external parties (e.g., customers, regulators, law enforcement)?

Escalation governance is the subject here, namely whether you have a documented procedure for coordinating incidents with internal stakeholders like management and legal as well as external parties such as customers, regulators, and law enforcement.

Effective incident escalation procedures ensure timely notification to decision-makers, technical teams, legal counsel, affected customers, and regulatory bodies when necessary, preventing communication breakdowns during critical incidents.

Evidence could include an incident response plan document that contains escalation matrices, contact information for stakeholders, criteria for different escalation levels, communication templates, and defined timelines for notifications. This document should clearly show when and how incidents are elevated to senior management, legal teams, customers, regulators, or law enforcement.