ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Escalation procedures depend on predefined criteria that map technical events to severity levels. Before any notification occurs, the responder must confirm that the event actually meets a playbook's High-severity threshold; otherwise, unnecessary alarms or delays can occur. Disabling the IAM user or starting a forensic acquisition may be appropriate later, but neither satisfies the immediate requirement to validate severity for timely escalation. Notifying law enforcement skips multiple internal steps and is only done after the incident commander authorizes it. Therefore, the first step is to compare the GuardDuty finding with the organization's escalation matrix and confirm that it qualifies as a High-severity incident, triggering the 15-minute escalation timer.