A post-incident review finds that a high-severity incident was correctly classified but waited almost a day before senior management was informed, because analysts escalated incidents in the order received. What should be improved?
Select an answer to reveal the explanation.
Short Explanation
Getting the severity right is only half the job; you need the label to make something happen. Each level should come with its own escalation path and a clock. Retraining analysts is the trap here; they classified it correctly, and the process just didn't act on it.
Full Explanation
Classification exists to drive the response. Each severity level should be linked to who must be informed, by when and through which channel, so that a high-severity incident moves immediately to the incident manager and senior management, ahead of lower-priority work. Without that link, a correct classification does not change handling, as the first-in, first-out queue shows. Retraining analysts on recognizing high-severity incidents addresses a problem the review did not find; the incident was correctly classified, so the gap lies in what happens after classification. Adding analysts may shorten queues generally but still processes incidents in arrival order, so a high-severity incident could wait behind lower-priority work whenever volume rises. Requiring senior management to review the full queue each morning shifts operational triage to executives, adds noise and still allows up to a day's delay. Exam caveat: escalation time frames should reflect the impact defined for each level and any regulatory notification obligations that may follow. Operational check: confirm the incident response plan sets a maximum escalation time for each severity level and that ticketing reports show high-severity incidents meeting it.