Incident Escalation Procedure
IT IT Ops
The prompt
Create procedure for recognizing security-relevant incidents and escalating to security team while preserving evidence.
Why this works
Service desk as first responder can catch incidents early. Evidence preservation is critical for forensics.
Risks & review
Service desk may over or under-escalate. Non-trained investigation destroys forensic value.