Anthropic-Cybersecurity-Skills/skills/building-soc-escalation-matrix/references/standards.md

Standards - SOC Escalation Matrix

NIST SP 800-61 Rev 2 Incident Handling

• Defines incident categories and severity levels
• Recommends functional impact, information impact, and recoverability as factors
• Guides escalation based on incident classification

ITIL Incident Management

• P1-P4 priority classification framework
• Impact x Urgency = Priority matrix
• SLA management for each priority level

SOC-CMM (SOC Capability Maturity Model)

• Level 1: Ad-hoc escalation, no formal process
• Level 2: Defined escalation paths, documented SLAs
• Level 3: Automated escalation with SOAR integration
• Level 4: Context-driven escalation with risk scoring
• Level 5: AI-assisted prioritization and auto-escalation

Response Time Standards

Priority	Industry Standard	Best Practice
P1	15 min response, 4h resolution	5 min response, 2h containment
P2	30 min response, 8h resolution	15 min response, 4h containment
P3	4h response, 24h resolution	2h response, 12h resolution
P4	8h response, 72h resolution	4h response, 48h resolution