Escalation decision: Close or escalate
On this page
Resolve stage · phase 6 of 7
Close or escalate, and who needs to know?
The Escalation decision is where the close-or-escalate call is made and recorded. Most triaged cases close here, as a documented, first-class verdict; the ones that meet a criterion leave with a handoff packet that lets the next tier start strong. Either way, the deliverable is a record the next reader can trust.
What the Escalation decision is for
Risk scores the case and recommends a move; the Escalation decision makes the call and records it. A documented close is a full outcome, held to the same evidence standard as an escalation. When the answer is escalate, Escalation is not just “send it to the IR team.” It is the deliberate, documented handoff of the work the triage analyst has done so far, in a form the next tier can pick up without re-investigating. Done well, escalation makes incident response Incident Response The organized approach to handling a security incident once it is declared. The classic lifecycle (NIST SP 800-61r2, withdrawn in 2025, and SANS PICERL) runs preparation; detection and analysis (identification); containment, eradication and recovery; post-incident activity (lessons learned). NIST SP 800-61r3 (April 2025) now maps incident response onto the CSF 2.0 functions (Govern, Identify, Protect, Detect, Respond, Recover). Triage is the front edge of that lifecycle; ASSURED ends where IR takes ownership. start from where triage finished. Done poorly, it costs the IR team hours of rework; teams that measure their triage track exactly that rework as a first-class signal.
What you will get from this chapter
The five pillars
Close or escalate: the criteria
The E rule, the thresholds that trigger escalation regardless of who is on shift, and the closure check a documented close must pass.
ReadInternal and external protocols
Tier 1 / 2 / 3 responsibilities, plus organizational stakeholders (IT operations, legal and compliance, HR, business units, communications) and external parties (insurers, vendors, customers, regulators, law enforcement) when they apply.
ReadTriage vs. incident response
Triage frames the puzzle; IR completes it. The two are different work, and the difference decides what a clean handoff contains.
ReadPreserve before you contain
Capture what a pre-authorized action would destroy, run the tip-off check, and record custody, then contain with reversible actions only.
ReadThe handoff packet
The structured deliverable an escalation produces. What it contains and why each piece matters.
ReadA companion page sits beside the pillars: Talking to people during triage, for verifying with users and owners without tipping off an attacker or an insider.
The Escalation decision at a glance
- Question
-
Close or escalate, and who needs to know?
- Takes in
- Risk’s priority band, matrix cell, confidence, and recommended move, plus any criterion flagged in an earlier phase.
- Deliverable
- A closure record for a documented close, or a handoff packet for an escalation. Either way, the decision with its time, its route, and its reasoning, and a communication record of who was told what.
- Done when
- The decision is recorded in the E fields; a close has passed the closure check, or an escalation has been accepted by a named receiver; every notification is in the communication record.
| Level | At this level, Escalation decision is |
|---|---|
| Level 0 pattern close | The pattern close is an early Escalation decision, recorded as field 5 of the five-field record. No packet and no notifications beyond the record. |
| Level 1 standard triage | The E rule applied to Risk’s recommendation in a few minutes: a documented close that passes the closure check, or an escalation with a packet. |
| Level 2 full arc | The full chapter: the E rule, the closure check or the packet with a warm handoff, the stakeholder map, and preservation before any containment. |
| Any level | A confirmed criterion is an early Escalation decision from whatever phase the case is in: the escalation tripwire. |
Four reasons it is a phase of its own, rather than the last line of Risk:
- The record is the artifact. An escalation is worth what the next tier can act on without re-investigating; a close is worth what a future reader can trust about the absence of compromise.
- Triage and IR are different work. Confusing them produces premature escalation (IR doing triage’s job) or delayed escalation (triage trying to do IR’s). This is where the analyst decides which work the case now needs.
- Criteria beat judgment under pressure. Pre-defined criteria are the SOC’s collective judgment encoded ahead of time, so a pressured analyst does not hesitate on a case that should have escalated an hour ago.
- Paths outside the SOC exist. IT operations, legal, HR, communications, an insurer, a vendor, a customer, a regulator through counsel, or law enforcement through counsel: this phase knows which one applies and when.
Key takeaway
The Escalation decision closes the case or hands it on, and records why either way. A documented close is a first-class verdict; an escalation turns the triage analyst’s work into someone else’s starting point. The cleaner the record, the better the next decision.