ISO/IEC 27035 FAQ Escalation

Escalate when the incident is not under control, can cause severe adverse impact, exceeds the current coordinator's authority, needs more or different responders, or approaches an organization-defined time or impact limit. Route the relevant decision when legal, contractual, safety, privacy, insurance, supplier, continuity, or communications criteria may apply. Examples include seeking approval to isolate a critical production service, activating crisis management after core services stop, asking privacy counsel to assess an affected-person notice, or calling a supplier whose evidence or recovery action is required.

The handoff should state current facts and uncertainty, severity and scope, affected information, systems and services, actions taken, outstanding decisions, evidence location, time constraints, required authority, and the next checkpoint. A named recipient must acknowledge the request and either accept ownership or redirect it to a named alternate; copying a mailbox or manager does not complete the handoff.

The record should prove that the trigger was recognized, the right authority received enough information, ownership was accepted, and the response changed. Keep the trigger, timestamp, initiator, recipient, acknowledgement, requested decision or resource, decision, revised priority, and next checkpoint.

Record failed and delayed routes too. They show where contact lists, on-call coverage, authority limits, supplier commitments, or crisis activation rules need correction.

Route operational escalation to the incident coordinator or another incident response team when the need remains within delegated response authority. Route decisions beyond that authority to the named management, crisis, business, finance, legal, privacy, safety, communications, or supplier authority.

The recipient must be able to decide the requested issue. Seniority alone is not enough if the person cannot authorize service interruption, external spending, public communication, risk acceptance, or another required action.

Reassess during the incident whenever impact, spread, recoverability, evidence risk, affected services, supplier involvement, or time pressure changes. Escalation is not a one-time severity label; the response can move up, across to a specialist team, or back to normal ownership when defined exit criteria are met.

Review the standing path after incidents, exercises, reorganizations, supplier changes, and changes to critical services or authority limits.

ISO/IEC 27035 is global, voluntary guidance for organizations of any type, size, or nature, including external incident-management service providers. Part 1:2023 defines the process and roles, Part 2:2023 covers planning and preparation, and Part 3:2020 covers ICT response operations. The series does not create a universal severity threshold, escalation deadline, regulator-notification clock, or legal power to interrupt a service.

The organization should set internal triggers, response targets, delegated authority, backups, and hand-back criteria from its risk and operating context. Binding laws, regulator rules, contracts, insurance terms, employment rules, and customer commitments can impose separate recipients, deadlines, or approvals. Apply those controlling requirements independently; an internal escalation level does not prove that an external reporting threshold is met.