Transition to the Escalation decision
On this page
Risk delivered a scored case and a recommended move. The Escalation decision now makes the close-or-escalate call and records it; when the answer is escalate, it is also the point where triage hands the case to response.
The handoff contract
- Deliverable
- The Risk verdict block: impact, likelihood and confidence with their rationale, the cell and priority, any override that fired, open questions and a recommended move. If the case escalates, it becomes section 5 of the handoff packet.
- Close path
- P4 recommends a documented close. P3 keeps working to its named re-score trigger, then recommends close or escalate. An undetermined verdict names its gaps and a re-score trigger; it never closes silently.
- What the next phase asks
- Close or escalate, and who needs to know? The Escalation decision applies one rule: escalate if a criterion is confirmed or the matrix places the case at P1 or P2; at P3, keep working to the trigger, then decide; close at P4. The four canonical criteria and the handoff packet live there.
- Depth
- A Level 0 close never reaches this handoff: it is an early Escalation decision recorded in the five-field record. Level 1 hands over a few lines; Level 2 hands over the full RATM record.
- You are ready if
- a reviewer who has not seen the case could read your cell, band and recommended move and reach the same call;
- nothing that went unexamined is scored Low, and every P3 or undetermined case has a re-score trigger with a time.
The loop ends here, or it doesn’t
For an unresolved case, the Scope → Uncover → Risk loop ends when the residual risk is understood well enough to justify a resolution. If the evidence is still ambiguous, refine the scope and run it again, but on the clock the matrix set: a High-impact case whose uncertainty comes from missing evidence is already P2 and escalates within 4 hours while the loop continues.
The loop is never a reason to sit on a confirmed criterion. A loop that is confirming new lateral movement Lateral Movement Moving from the initial foothold to other hosts, identities or tenants to find sensitive data or reach higher-value targets (ATT&CK tactic TA0008). It usually rides legitimate remote-access protocols (RDP, SMB, WinRM, SSH) with stolen credentials, or replays a stolen session into a cloud or SaaS tenant, so the signal is an account authenticating where it does not normally go. Each hop widens the blast radius, and confirmed lateral movement is an escalation criterion. or data staging Data Staging Collected data consolidated in one place before exfiltration (a local directory, a file share, or a cloud instance), often compressed and encrypted into archives (T1560). Staging reduces the number of outbound connections. A multi-gigabyte .7z or .rar appearing in ProgramData, %TEMP% or a share root is one of the best pre-exfiltration detection opportunities. Splitting transfers to stay under thresholds is a separate technique (T1030). has already answered the escalation question: the escalation tripwire fires, IR takes ownership, and the loop keeps running as scoping support, as tasks the IR owner assigns, under IR’s clock. Suspicion iterates; confirmation escalates from wherever the investigation happens to be standing.
Key takeaway
Escalation follows confirmation and the priority band, not investigative completeness. Risk hands over a scored case and a recommendation; the Escalation decision makes the call, closes with a documented record or escalates, and the remaining work continues under IR’s clock.