Which step should occur when a threat requires escalation in the security system?

• A. Do nothing until a supervisor notices.
• B. Chat with peers about it.
• C. Escalation levels and ICS activation as needed.
• D. Close all incident reports.

Answer: (C)

Escalation means moving from detection to a formal, coordinated response using predefined levels. When a threat requires escalation, you follow those escalation levels and activate the ICS as needed to mobilize the right people, tools, and procedures. This creates a clear chain of command, accelerates containment and recovery actions, and keeps an auditable record of what was done. Waiting for someone to notice or relying on informal chats slows the response and can miss critical steps, while prematurely closing incident records stops the investigation. Activation of ICS at the appropriate level ensures the response is proportional to the threat and coordinated across teams.