building-soc-escalation-matrix

Define severity tiers (P1-P4) with response and resolution SLAs, map severity against asset criticality in a decision matrix, and assign each tier to named on-call rotations. Verify the matrix with a tabletop test injecting a synthetic P1 incident.

A common model uses four levels: P1 critical (15-minute response, 4-hour resolution), P2 high (30-minute response), P3 medium (4-hour response), and P4 low (8-hour response). Each level defines escalation timing and communication cadence.

Configure SOAR playbook triggers on conditions like severity equals critical and asset_criticality equals high, then assign tiers, notify managers, and start war rooms. Ensure enrichment populates the asset_criticality field before the playbook evaluates it.

Escalation rules fail when incident status is not updated to resolved on closure, causing double-paging, or when the scheduler is not running so SLA breaches never trigger. Verify the age and status fields are reliably maintained.

Severity-based escalation routes incidents purely on alert severity, while context-driven escalation combines severity with asset criticality, business risk, and data sensitivity. Context-driven models reduce false P1s and align response with actual business impact.