Incident Response and Management · Topic 4 of 6

Triage and Escalation

How CySA+ analysts triage alerts, judge severity from impact and urgency, scope an incident and escalate to the right people with clear communication.

5 min

In a nutshell

Triage is the quick check of whether an alert is real, how severe it is and who should handle it.
Severity combines impact and urgency.
Impact types are functional, information and recoverability.

What it is

Triage is the quick first assessment of an alert or report. The analyst decides whether it is real, how serious it is, what it touches, and who should handle it next.

Escalation passes an incident to someone with more skill, more authority or a duty to be informed. Good triage prevents small issues from consuming senior time, and good escalation stops serious issues from sitting unnoticed.

How it works

The triage questions

Is it real? Check for a false positive using a second source, the evidence in the alert and known benign causes.
What is affected? Systems, accounts, data and business services.
How far has it spread? One host, a segment or the whole environment.
What kind of data or function is involved? Personal data, payment data, production control or a test machine.
Is it still happening? An active attack is more urgent than a past one.
What is the likely cause or type? Malware, phishing, account misuse, data loss and so on.

Answers must come quickly, using the evidence at hand. A detailed investigation comes after the incident is accepted and assigned.

Severity and priority

Severity combines impact (how much harm) with urgency (how soon harm grows or must be stopped). Common factors are the criticality of affected systems, the sensitivity of the data, how many users are affected, whether the attack is active and how hard recovery will be.

Level	Typical sign	Typical handling
Low	One user, no sensitive data, no spread	Handle in normal queue
Medium	Several systems or minor data exposure	Same day response by the security operations centre (SOC)
High	Critical system or sensitive data at risk	Immediate response and management notice
Critical	Active, widespread or business stopping	Activate the full IR team and executives

The labels and times differ between organisations and are set by the incident response (IR) plan.

Three common impact types help classify incidents: functional impact (loss of ability to do business), information impact (loss or exposure of data) and recoverability (time and effort to return to normal).

Tiers

Many SOCs use tiers. A first tier analyst watches alerts and performs triage. A second tier analyst investigates confirmed or complex cases, and a third tier works on advanced analysis, hunting and tool improvement.

When and how to escalate

Escalation can go in two directions.

Type	Meaning	Example
Functional	Pass to a specialist with the right skill	Malware reverse engineering, cloud, forensic team
Hierarchical	Pass up to those with more authority	Manager, incident commander, chief information security officer (CISO)

Typical triggers include:

A critical or sensitive system is involved.
The incident is beyond the analyst's skill or access.
Regulated or personal data may be exposed.
The incident could affect customers, partners or the public.
A time threshold in the plan has passed without containment.
Law enforcement or legal involvement may be needed.
Insider activity is suspected, which needs careful handling with human resources and legal.

Many laws and contracts set deadlines for breach notification. For example, the General Data Protection Regulation (GDPR) in many cases requires notifying the supervisory authority within 72 hours of becoming aware of a personal data breach. The legal team decides what must be reported, so escalate early.

Communicating well

A useful escalation message is short and factual.

Who: analyst J. Lee, 14:20 UTC
What: file server FS02 shows mass renaming of files, ransomware note found
Scope: FS02 only so far, 3 accounts used, no other hosts confirmed
Action: FS02 isolated from the network, credentials for 3 accounts disabled
Need: incident commander approval to notify the data owner and begin recovery planning

Use the secure channel named in the plan. If email may be compromised, use an out of band method, and keep the circle of people informed to those who need to know. Keep updating the log with times, decisions and who was told.

Exam tip

When a question asks what to do when an incident exceeds your authority or skill, the answer is almost always to escalate through the documented path, not to act alone or ignore it.

What to remember for the exam

Triage is the quick check of whether an alert is real, how severe it is and who should handle it.
Severity combines impact and urgency.
Impact types are functional, information and recoverability.
Functional escalation moves to a specialist, and hierarchical escalation moves to higher authority.
Escalate when critical systems, sensitive data, legal duties or time limits are involved.
Breach notification laws have deadlines, so involve legal early.
Record who was told what and when.
Use out of band communication if normal channels may be compromised.
Do not alert a suspected insider through shared channels.

Common mistakes

Over investigating during triage. The first goal is a quick decision, and deep analysis comes once the case is assigned.

Waiting to escalate until sure. Delay costs time, so escalate when thresholds are met even if details are incomplete.

Treating every alert as critical. Without a severity method, real emergencies disappear in the noise.

Mixing up functional and hierarchical escalation. One goes sideways to a skill, and the other goes up to authority.

Leaving out the facts. An escalation with vague wording forces the next person to start again.

Check yourself

What two ideas combine to set incident severity?
Impact, meaning how much harm, and urgency, meaning how quickly it must be addressed.
What is functional escalation?
Passing an incident to a specialist team or person with the needed skills, such as malware analysis.
Why involve the legal team early in a suspected data breach?
Notification laws and contracts can set deadlines, and legal staff decide what must be reported.

Topic 4 of 6 in Incident Response and Management

Test yourself on Incident Response and Management

The full CompTIA CySA+ CS0-004 question bank has 654 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.