🚨 Escalation & Severity Language

Correct: B. Declaring a SEV-1 is not just a label — it is an activation trigger. Most incident response frameworks define specific actions that fire automatically when SEV-1 is declared: executive bridges are opened, on-call escalation chains are paged, update cadences are tightened to 10–15 minutes, and resources are cleared. The formal declaration ensures the response scales proportionately to the severity.

SEV-1 typically activates	SEV-2 typically activates
Executive bridge; tightest update cadence; full escalation chain	Senior engineering notification; regular update cadence

Correct: B. Without a severity matrix, severity classification becomes subjective and inconsistent — the same incident is called SEV-1 by one IC and SEV-3 by another. The matrix defines explicit thresholds: e.g., "SEV-1 = complete checkout unavailability affecting all customers." Pre-defined criteria remove debate during the incident itself, when time is critical.

Typical severity criterion	Example threshold for SEV-1
Customer impact	Core product unavailable for all or majority of customers
Revenue impact	Revenue stream entirely blocked (e.g. checkout down)
Data integrity	Risk of data loss or corruption

Correct: B. Executive notification criteria are defined in advance for the same reason as the severity matrix: to prevent subjective, pressure-driven decisions during the incident. Waiting for root cause before notifying executives is a common mistake — by that time the outage may have lasted an hour and leadership found out from a customer. Earlier, factual notification with clear impact framing is better than late notification with full explanation.

Trigger example	Why it warrants executive notification
Revenue stream fully blocked for >15 min	Financial impact; leadership may need to brief board or investors
Potential data breach detected	Regulatory / legal obligations; CISO and legal counsel must be looped in

Correct: B. An escalation chain is the pre-defined sequence of people to page when the current response team is stuck. It is tiered: primary on-call → secondary on-call → domain expert → engineering manager → VP of Engineering. Paging the chain is a recognition that more expertise or decision-making authority is needed — not a failure, but a correct use of the incident process.

Escalation chain tier	When paged
Primary on-call	Alert fires; initial response
Secondary on-call / SME	Primary stuck or needs domain expertise
Engineering manager / VP	Extended outage; executive visibility required

Correct: B. "Blast radius" is borrowed from the security and systems reliability lexicons. In incident command, a widening blast radius is a critical signal: the incident is no longer contained to the originally identified system. Each new service affected potentially means more customers impacted, more teams needed, and a higher severity classification. The IC must re-evaluate whether the current response scale and resource allocation is still appropriate.

Blast radius status	IC action
Contained (single service)	Maintain current response team and severity
Widening (multiple services)	Re-evaluate severity; page additional SMEs; consider exec notification