Which statement best describes when escalation should be used during incident handling?

• A. Only escalate after all teams have completed mitigation and documented lessons learned.
• B. Escalation occurs automatically for every incident.
• C. Escalation should be considered when the incident has a broad business impact but can be mitigated within the team.
• D. For high-severity, business-critical impact or when escalation requires cross-organizational resources.

Answer: (D)

Escalation should happen when an incident has high severity or business-critical impact, or when solving it requires resources beyond the current team. This lets you bring in the right people quickly—external experts, other departments, or cross-organizational partners—so containment and recovery happen faster and with proper coordination. Waiting until mitigation is already complete delays awareness and can widen impact, and escalating for every incident wastes time and resources. If the incident affects the business at a level where broader collaboration is needed, or you’re up against cross-team dependencies, escalation is the prudent move. Use a clear severity scale and escalation path so teams know when and who to involve.