Analysts are unsure whether a developing incident is serious enough to inform senior management. Some want to wait until the root cause is known. When should senior management be informed?
Select an answer to reveal the explanation.
Short Explanation
Escalation shouldn't be a gut feeling. You set the tripwires in advance, and when one trips, the call goes up the chain. Waiting for the full story is the trap: by then the window for executive decisions may have closed.
Full Explanation
Defined escalation criteria translate the organization's risk appetite into clear triggers for involving management, based on factors such as the criticality of affected systems, the type and volume of data involved, regulatory implications, customer impact and potential reputational harm. When an incident meets those criteria, senior management is informed promptly so that it can make decisions only it can make, such as approving business-affecting containment, engaging counsel or authorizing disclosure. Predefined criteria remove hesitation and inconsistency. Waiting until the root cause is known delays executive involvement, sometimes by days or weeks, and decisions with time limits, such as regulatory notification, may be missed; management can be briefed on facts known so far and updated. Escalating every security alert floods executives with operational noise, obscures the incidents that matter and misunderstands their role. Waiting until the media is aware ties escalation to an external event outside the organization's control and means leadership learns of serious incidents from the press. Exam caveat: criteria should be reviewed as the business and threats change, and responders should be trained to apply them. Operational check: confirm the criteria are documented, each escalation is time-stamped in the incident log and exercises test escalation timing.