Internal and external escalation protocols
On this page
Where the case goes matters. Internal tiers define who picks up; organizational stakeholders own the non-technical consequences; external parties come in when the response goes beyond the organization.
Internal tiers
ASSURED is written for the analyst who owns the case from alert to verdict, Tier 1 or Tier 2 depending on staffing. In a strict three-tier SOC, Tier 1 often stops after Scope and tiers the case up for Uncover and Risk; the packet structure is the same either way. Two verbs keep the moves apart: tier up hands a case to the next tier inside the SOC; engage IR brings in incident response, on the escalation tripwire or a P1 or P2 cell. The escalation tripwire engages IR directly and bypasses the tiers. (These SOC tiers are analyst roles. They are unrelated to Active Directory and Entra administrative tiering, where Tier 0 means the identity systems themselves.)
Initial detection and triage
Receives alerts, validates the signal, applies initial triage protocols to categorize events by type and priority. Records the two-axis verdict (detection correctness and activity disposition). The Alert, Subject, and Scope work usually lives here, and in many SOCs the whole case. Tiers up anything that exceeds the Tier 1 mandate, and engages IR on a confirmed criterion.
- Alert validation and preliminary risk assessment
- Documented benign closes (false positive or benign true positive) with detection feedback
- Categorization by event type and priority
- Initial scope and entity identification
In-depth investigation
Incident responders and senior analysts pick up escalated cases. They conduct deeper technical investigation, develop containment strategies, and create remediation plans for confirmed incidents.
- Technical analysis with deep forensic capability
- Containment planning and remediation design
- Decision on whether the case becomes a declared incident (in this model; many organizations name one role for it, such as the IR lead or incident commander)
- Coordination with detection engineering for rule refinement
Senior technical escalation
The deepest technical bench: senior analysts and specialists who take the cases Tier 2 cannot close. Malware reverse engineering, memory and disk forensics, sophisticated-adversary investigation, and proactive threat hunting when not working escalations. Tier 3 is still technical work, done by the SOC’s most experienced hands.
- Malware analysis and reverse engineering
- Advanced forensics: memory, disk, timeline reconstruction at depth
- Sophisticated-adversary and novel-technique investigation
- Threat hunting and detection-content development between escalations
Incident command is a function, not a tier
When a case becomes a declared incident, a different structure activates alongside the tiers: incident command Incident Command A leadership model for running a major incident, adapted from emergency management's Incident Command System: one incident commander, defined roles (operations, communications, scribe) and a single source of decisions. Triage meets it at the handoff: on a P1, the warm handoff goes to whoever holds command. (modeled on the Incident Command System used in emergency management), with an incident commander who orchestrates the response, legal counsel for compliance, communications for stakeholder messaging, and executive leadership for strategic decisions. That cross-functional coordination is often mislabeled “Tier 3,” but it is a separate function that draws on the tiers rather than sitting above them. A Tier 3 analyst may be the technical lead inside that structure; they are not the incident commander by default.
Tiers are roles, not org charts
Pod-based teams, managed detection and response (MDR) providers, and AI triage agents all fit the model: whoever (or whatever) does Tier 1 work produces the same handoff packet, and for a provider the customer escalation is the handoff packet. Per the governed automation tier and the controls in AI governance, an agent may draft the packet and the notifications, but the decision to escalate, and who gets paged, stays with a named analyst. Tier boundaries are set by written criteria and mandates; capacity and confidence are legitimate reasons to escalate early.
The tier model at 3 a.m.
The tier language assumes staffed tiers, and most SOCs are not staffed that way around the clock. On nights and weekends the tiers often collapse into one analyst and an on-call rotation. The model still applies (the one-person SOC covers the staffing side); what changes is the transport. Escalation means paging the on-call responder, not walking a case to the next desk, and the pre-authorized immediate actions matter most in exactly this window, because waiting for a phone to be answered is the cost of not having them.
Capacity is a legitimate operational escalation route, separate from the four evidence-based criteria: a single analyst who cannot both watch the queue and work a confirmed case escalates on that basis alone, and using it is not a failure.
Paging and acknowledgment
A page is not a handoff until someone acknowledges it. Every P1 and P2 page has an acknowledgment window, set by the default clocks: a P1 pages immediately and falls back at 15 minutes with no acknowledgment, and a P2 is acknowledged within 15 minutes. Adopters tune these to their paging model; what must survive is that the window exists and someone watches it.
When the window lapses, the page moves down a written fallback chain:
- The primary on-call responder (the IR lead or Tier 2 on-call).
- The secondary on-call, at the end of the acknowledgment window.
- The SOC manager, if the secondary does not answer either.
- Meanwhile, triage preserves and takes the reversible pre-authorized actions; it does not wait for the phone.
If the receiver declines a case you believe meets a confirmed criterion, record the disagreement in the packet and escalate to the IR lead. Disagreement is not insubordination.
The P1 page. The page itself carries the five-minute read, in six lines:
Case: case ID, and the alert or incident ID it relates to
Priority and route: P1, and the route that fired (the criterion confirmed, with its time)
Summary: one line on what is happening and what is still live
Already done: what is preserved and what is contained, with times
Join: the bridge or channel, outside any affected tenant
From: who is paging, and how to reach them out of band
The handoff-packet.md template records the page, the acknowledgment, and the warm handoff in its P1 page block, and the receiver fills in the receipt.
Escalate out of band when the attacker may be listening
If the incident touches email, chat, or identity, escalate and coordinate out of band: a phone bridge, a pager, or a pre-provisioned channel outside the affected tenant. The adversary may be reading the mailbox or the chat workspace the page would go through. Never notify a suspected victim by email from the affected tenant, and record the channel used for every notification. Out-of-band communication gives the channel ladder, and verifying with the user covers users, owners, and executives when the usual channels cannot be trusted.
De-escalation: the path back down
Escalation is not one-way. Two legitimate reverse flows exist, and modeling them keeps the tiers honest.
Tier 2 can hand a case back. A rejection is a quality signal with a named reason: the packet lacks the evidence chain, the criteria claimed are not actually met, or the case is really a detection-tuning problem rather than an incident. The case returns to Tier 1 with the reason recorded, the gap gets fixed (or the close gets written), and the reason feeds the same loop as false-positive patterns: repeated rejections for the same gap point at packet quality or criteria calibration, not at an individual analyst. A confirmed criterion is handed back or de-escalated only by the receiving owner, never by the analyst who raised it. Case D shows a handback with its receipt and the P2 to P3 downgrade.
Priority can move down as well as up. A P1 declared on strong initial evidence de-escalates when the evidence weakens under investigation, with the same discipline as the upgrade: a named reason in the record, and every stakeholder who was notified of the escalation notified of the downgrade. A case that can only ever get more severe trains analysts to under-declare in the first place.
Both flows are measurable. Time from the first confirmed criterion to the page, handback rate by reason, and de-escalation rate belong beside the other triage-quality measures; the worked example’s late P1 is exactly what the first one catches.
Organizational stakeholders
Internal escalation moves the case from Tier 1 to Tier 2, and on to Tier 3 only when it needs specialist depth. Established protocols then govern when to engage other owners inside the organization.
IT Operations
Engaged when system or network-level compromises require configuration changes, patching, or network-wide defensive measures. Containment in production environments often needs IT Ops on the call.
Legal & compliance
Engaged when events potentially affect regulated information. Assesses reporting obligations and legal implications, and owns every notification to regulators. Often early in the timeline for incidents with regulatory exposure: some clocks run from awareness, not confirmation (see Scope: regulatory).
The insider route (HR and legal)
When the subject is an employee or contractor, the escalation puts the IR lead, the insider-program lead (or HR, where no program exists) and legal on one bridge. Preserve under legal hold with a chain-of-custody record; take reversible, quiet containment first; time the visible steps (account suspension, the conversation with the subject) with legal. Need-to-know only: restrict case visibility, do not notify the subject’s manager or team, and keep the case out of reach when the subject works in IT or the SOC. Analysts record observable technical activity; HR-held context reaches the case only through the insider-risk route, and never as analyst-collected notes. The HR referral example runs this route end to end.
Business units and asset owners
Engaged for business-specific incidents affecting departmental systems or data. Ensures remediation aligns with operational requirements and that affected workflows are restored. Physical security joins when the case has an on-premises component.
Communications
For incidents that may become public. Press, customer, and partner messaging is its own workstream. Legal counsel coordinates with comms before any external disclosure.
External parties
Insurer / breach coach
Notify per the policy terms, often before engaging outside IR or counsel. Prompt notice is often a coverage condition, and many policies name panel IR firms and breach counsel. Legal or risk management usually owns the call.
IR retainer
An external IR firm on retainer extends Tier 2 and Tier 3 when the case outgrows in-house capacity. Know the activation path and the contractual response time before you need them.
Vendors
When the incident involves a vendor’s product, platform, or data. Vendor disclosure may be required by contract. Coordination follows the terms of the master service agreement (MSA) and data processing agreement (DPA). Inbound vendor notices (a SaaS provider or processor reporting their own breach) enter triage as an alert (see external notifications): Subject is your accounts and data at that vendor, and the clock may already be running from their awareness, not yours.
Customers (MSSP / MDR)
For a managed security service provider (MSSP) or MDR provider, the escalation is the customer notification, delivered on the contract’s service-level agreement (SLA) through the channel the contract names, and the customer escalation is the handoff packet. The customer’s own escalation chain takes it from there.
Regulators and government
Data protection authorities, national computer security incident response teams (CSIRTs), and sector regulators. Legal owns every notification; the SOC’s job is to know which clocks apply and to hand legal the facts in time (see Scope: regulatory and the regulatory clock card).
ISACs and peers
Share indicators and campaign context with an ISAC Information Sharing and Analysis Centers (ISACs) Sector-based organizations (FS-ISAC, Health-ISAC and others) through which members share threat intelligence, indicators and incident experience under agreed handling rules. For triage they are a source of early, sector-specific indicators; respect the TLP marking on what they share. or trusted peers under the Traffic Light Protocol (TLP 2.0), after legal review.
Law enforcement
For criminal activity, extortion, or cross-border threats. Engaged through legal counsel, not directly by the SOC (an inbound notice from law enforcement enters triage as an external notification); engagement decisions usually require executive sign-off. Ransomware and extortion: legal engages the FBI (through its Internet Crime Complaint Center, IC3, or a field office) early, and any payment discussion requires sanctions screening against the Treasury Office of Foreign Assets Control (OFAC) lists. Early engagement matters for the clocks too: a law-enforcement request is a recognized ground for delaying notice under many breach laws, including California’s, and only a US Attorney General determination can delay a Form 8-K Item 1.05 filing, so record when law enforcement was engaged. Covered US critical-infrastructure entities should track the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA), which will add incident and ransom-payment reports to the Cybersecurity and Infrastructure Security Agency (CISA) once its final rule takes effect; it is not yet in force.
Exercise the protocols
A protocol nobody has run is a guess. Test the paging chain, the out-of-band bridge, and the external contacts in tabletop exercises, refine them from the lessons learned Lessons Learned The post-incident step, in the NIST and SANS lifecycles alike, that turns a case into changes to detections, playbooks, controls and training. Triage records feed it, so a well-written closure record or handoff packet is what makes the lesson findable later. See Post-Mortem. of real incidents, and keep the contact list, the thresholds, and the decision authorities current. The first time an analyst discovers that the insurer’s hotline number is stale should not be during a ransomware case.
Key takeaway
Internal tiers handle the technical work. Organizational stakeholders and external parties handle the non-technical consequences. All three are part of the escalation map, and all three should be tested before they are needed under real-incident pressure.Technical details verified . Product names, defaults and retention change; check your own tenant.