A confirmed breach of a 311 call-center database may require notice beyond the SOC. What escalation practice is most appropriate?
Select an answer to reveal the explanation.
Short Explanation
When a 311 breach crosses the line, the SOC should not be a secret society. Escalate on criteria to leadership, legal, and maybe public communications. Personal note silos and waiting for the newspaper are bad escalation paths.
Full Explanation
Incident escalation criteria tell a municipal SOC when an event must leave the analyst queue and reach leadership, legal, and public communications. Clear paths—who is called, by what channel, with what minimum facts—prevent both under-notification that blinds executives and over-notification that creates noise. Breaches involving 311 or other citizen-facing systems often meet criteria for privacy, operational, and reputational impact; legal counsel advises on regulatory notification, while communications prepares accurate public messaging once facts stabilize. Escalation on defined triggers preserves chain of command and evidence handling rather than improvisation under stress.
Keeping the incident entirely within one junior analyst’s personal notes indefinitely delays containment resources and creates single-person knowledge risk. Escalating only to unrelated vendors who have no role in response wastes time and may leak sensitive details without benefit. Delaying all leadership notification until after media outlets publish the story forces the city into reactive crisis mode and erodes trust. Exam caveat: escalation thresholds should be written and tested—severity, data sensitivity, and service impact drive who joins the bridge. Operationally, maintain an on-call roster with legal and PIO contacts, define severity criteria for 311/citizen data events, and log every escalation with timestamps in the incident ticket.