The hardest call in an incident is not technical — it is when to wake the CEO. This matrix gives you the structure to answer it on a rule, not a hunch: severity tiers scored on written criteria, who is notified at each tier and how fast, the objective triggers that auto-escalate to leadership, and the separate external-notification triggers — so you never miss a real SEV1 or cry wolf.
Educational template — not legal advice. External-notification and disclosure concepts are summarised for orientation and vary by jurisdiction; adapt this with qualified counsel.
Free · no signup · adapt it in your own doc
Incident Escalation & Notification Matrix
A one-page operating rule for when an incident stops being an operational event and becomes something you wake the CEO and brief the board over. It fixes the severity tiers, who is notified at each tier and how fast, the objective triggers that auto-escalate to leadership, and the separate external-notification triggers — so the 2am call is applying a rule, not inventing one.
01Severity tiers (classify on criteria, not vibes)
Score every signal against these written, observable definitions. When a signal sits genuinely between two tiers, default UP and let the incident commander confirm. The CEO/board column is what forces leadership involvement — see section 3 for the objective triggers behind it.
SEV
Definition
Examples
CEO / board?
SEV1
Confirmed or credible high-impact incident — material business, safety, legal or regulated-data impact
Ransomware actively spreading; confirmed exfiltration of regulated data; safety-of-life impact; major customer-facing outage past the defined duration
Yes — auto-escalate (section 3)
SEV2
Significant incident, contained or containable, impact limited to a business unit
Compromise of a non-critical system; limited data exposure under investigation
Brief if likely to rise to SEV1 or draw external attention
SEV3
Suspected or early-stage event needing investigation, no confirmed material impact
Anomalous admin login confirmed; isolated malware on one endpoint
No — on-call tier handles
SEV4
Routine / low-impact event handled in normal operations
Single failed-login burst, blocked by controls; policy noise
No
Classification runs off observable facts, not seniority or instinct. A junior analyst applying the criteria and a VP applying them should reach the same tier.
02Notification matrix (who, how, how fast)
For each tier, name exactly who is notified, on which channel, and within what timeframe — so no one invents the routing mid-incident. Define the after-hours (2am) rule explicitly: which tiers justify a phone call at any hour vs. a next-business-hours ping.
SEV
Who's notified
Channel
Timeframe
SEV1
Incident commander + CISO + CEO; legal, comms and board per section 3
Phone call — wake at any hour
Within 30 minutes
SEV2
IC + CISO + affected business owner
Phone/chat; wake after-hours only if trending to SEV1
Within 1 hour
SEV3
On-call lead; escalate to IC if criteria met
Chat / ticket
Within 2 hours; next business hours overnight
SEV4
On-call queue
Ticket
Normal operations
After-hours (2am) paging rule
Which severities/triggers justify a phone call at any hour, and to which roles
Primary + backup contacts per role
Names, numbers, and the escalation path if a contact does not answer
Any ONE of these, once observed, auto-escalates to SEV1 and mobilises leadership — regardless of who is on call and regardless of an optimistic "we are nearly done" estimate. The trigger fires on the observable fact; you can always de-escalate later (section 5).
Confirmed or credibly suspected exfiltration of data (especially regulated or sensitive data)
Ransomware or destructive malware actively spreading beyond its initial host
Any safety-of-life or physical-safety impact
Exposure of regulated data (personal, health, payment, or otherwise legally protected)
Customer-facing outage or degradation lasting beyond defined duration, e.g. 30 minutes
Credible indication the incident is or may be material to investors / the business
A series of related smaller events that, in aggregate, cross a SEV1 threshold
Escalate on uncertainty when the impact-if-true is severe. For a credible high-impact signal you do NOT wait for full forensic confirmation before warning leadership — you brief early on what is known and what is not, and refine as facts firm up.
04External-notification triggers (separate from internal paging)
Internal paging decides who on your side is woken. External notification to regulators, customers or law enforcement is a DIFFERENT decision, governed by its own legal thresholds and statutory clocks, and assessed deliberately with counsel — never auto-fired just because an internal SEV1 was declared.
Regulatory notification
Which regulators, what threshold, what statutory clock — assessed with legal
Customer / data-subject notification
Trigger, timeframe and channel per applicable law and contracts
Law enforcement
When and who contacts them; how it interacts with disclosure
Securities / disclosure clock
If public: when the materiality assessment and any filing clock start — see the 8-K memo template
Keep the two matrices distinct. Conflating them either triggers premature external notice or buries a real legal duty inside an operational call.
05Roles & the de-escalation rule
A single owner holds the severity and every escalation/de-escalation call; others advise. De-escalation is as explicit as escalation, so the tier always reflects reality and the pager stays believable.
Incident commander (IC)
Owns current severity and every move up/down; the one voice to leadership
Scribe
Records the decision trail — times, severity changes, who was notified
Communications lead
Owns internal/external messaging once looped in; no messaging without IC sign-off
One incident commander decides — leadership never receives three different severity numbers for the same incident.
De-escalate explicitly: the IC records the new (lower) severity, states the basis, and tells everyone who was paged they can stand down — never a silent downgrade.
If a signal is genuinely ambiguous between two tiers, default up and let the IC confirm; do not burn the containment window arguing severity.
Review and rehearse this matrix before you need it (e.g. in a tabletop). The 2am call should be applying a pre-agreed rule, not relitigating it half-asleep.
Practice the decision
This matrix records calls you can rehearse. The free Escalation Threshold Lab puts you on the pager at 2am and grades you on ~14 of the exact decisions this matrix captures — classifying an ambiguous signal, setting the threshold, who gets woken, and when the board is looped in.
TL;DR
What this template is
A one-page operating rule that fixes when a cyber incident gets escalated to the CEO and board: severity tiers scored on written criteria, who is notified at each tier and how fast, the objective auto-escalation triggers, and the separate external-notification triggers.
Sections: severity tiers (with a CEO/board column), the notification matrix (who/channel/timeframe + the 2am paging rule), the objective SEV1 auto-escalation triggers, the external-notification triggers, and roles plus the explicit de-escalation rule.
Built to avoid both failure modes — the missed SEV1 treated as noise, and the crying-wolf over-escalation that teaches leadership to mute the pager.
Copy it or download it as Markdown and adapt it in your own document — nothing is uploaded.
Practise the underlying decisions in the free Escalation Threshold Lab. Educational template — not legal advice.
Frequently asked questions
What is this template for?+
It is a one-page escalation and notification matrix that records how your organisation decides when an incident reaches the CEO and board. It captures the severity tiers and the criteria for each, who is notified at each tier and within what timeframe, the objective triggers that auto-escalate to leadership, and the separate external-notification triggers for regulators and customers.
How does it stop both under- and over-escalation?+
By replacing nightly instinct with written criteria and objective triggers. Under-escalation — a real SEV1 handled as routine noise — loses the early containment window, so the triggers are set so credible high-impact signals clear the bar reliably. Over-escalation erodes trust in the pager, so the triggers are objective and the tier is de-escalated explicitly once the facts narrow, keeping the top tier believable.
Why separate internal paging from external notification?+
Internal paging decides who on your side gets woken and mobilised. External notification to regulators, customers or law enforcement runs on its own legal thresholds and statutory clocks and must be assessed deliberately with counsel. If you fire them from the same trigger you either notify externally too early or bury a real legal duty inside an operational call, so the template keeps the two matrices distinct.
Is this legal advice?+
No. It is an educational template. External-notification and disclosure concepts are included for orientation and vary by jurisdiction and over time; confirm the duties that apply to your organisation, and their timeframes, with qualified counsel.
🎉 New here? Use code WELCOME10 for 10% off any plan at checkout