Incident Escalation Matrix Template

Every escalation matrix template hands you the same four adjectives. Critical, major, minor, cosmetic, with acknowledge times somebody picked because they sounded proportionate. Adjectives do not survive two in the morning. Nobody woken by a pager compares what they are looking at against a written definition; they ask whether this is as bad as the last bad one. So every level here is written around the real incidents that landed in it, with dates and durations, and classification becomes a lookup.

The definitions everybody ships are written from the postmortem's point of view: data loss, revenue impact, all customers affected. None of that is knowable while the pager is going off. Federal incident handling guidance concedes it, asking handlers to weigh the current impact and the likely future impact if the incident is not immediately contained. So the index is the symptom: what the alert says, whether the thing fails or is merely slow, whether support has a workaround to hand out.

Then the ladder nobody ships. Every template escalates when nobody is making progress, and none of them escalates when nobody answered at all, which is the failure that actually happens after midnight. It has different intervals and it starts by duplicating the call. The same real-history logic sets response targets for slower internal requests too, in the internal service SLA pack. Send River the incident history, or take the sheets blank, alongside the map of the process the incident interrupts, the matrix saying who owns each step and the runbook built from the same history.