IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
Under what other circumstances escalation is required should then be
specified. Possible grounds for escalation are as follows:
- The expected level of damage exceeds the area of responsibility of the
person who received the report.
- The costs and resources required to control the damage exceed his area of
competence.
- The complexity of the security incident exceeds his competence or area of
responsibility.
Stage 3: Manner of escalation
It is now necessary to specify how the next level up in the escalation chain
should be informed. The options are:
- in person
- written report
- E mail
- telephone, mobile phone
- messenger with sealed envelope
The timescale within which notification should occur must also be specified.
Examples are:
- events which require immediate escalation: within one hour;
- events which require immediate measures: within one hour;
- events which may be under control but still require that the next escalation
level is notified: the next working day.
This escalation strategy should be notified to all possible recipients of reports
of security incidents so as to ensure a prompt response.
To contain a security incident, it is usually necessary to take action promptly.
It may be necessary to recall staff from other projects or to call them in out of
working hours. Procedures must therefore be defined as to how the necessary
additional work is to be handled and how to ensure that staff are on call (see
also S6.59 Specification of responsibilities for dealing with security incidents).
Additional controls:
- When was the escalation strategy last updated?
- Have the escalation channels been tried out in exercises/practice runs?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
How should the alerting
be done?
Procedures regarding
overtime