What is an escalation policy?
An escalation policy is the ordered set of rules that decides who is alerted about an incident and what happens if nobody responds: page the primary on-call engineer, and if the alert is not acknowledged within a set time, page the secondary, then a team lead. It turns a missed page into a short delay instead of an unhandled outage.
Why an escalation policy matters
People sleep through phones, lose signal, or are already busy with another incident. Without escalation, one missed page means the incident waits until someone happens to notice. With it, the cost of a miss is bounded by the acknowledgement timeout.
Writing the policy down also settles questions nobody wants to debate at 3 a.m.: who the backup is, when a manager hears about it, and which alerts never escalate because they can wait until morning.
How to measure an escalation policy
time until level n is notified = sum of the acknowledgement timeouts of levels 1 … n−1 worst case before anyone acts = detection time + all timeouts
Worked example
A policy pages the primary on-call engineer, escalates to the secondary after 5 minutes without acknowledgement, and to the engineering lead after a further 10 minutes. Checks run every minute with a 12-second confirmation.
- Level 2 (secondary) is paged 5 minutes after the alert if nobody acknowledges.
- Level 3 (lead) is paged 5 + 10 = 15 minutes after the alert.
- Detection adds up to about 60 + 12 = 72 seconds, so the lead could be paged about 16 minutes after the outage starts.
Result: If your monthly error budget is 43 minutes, an unanswered page at level 1 already costs a third of it. Short first timeouts matter more than many levels.
Common mistakes
- Timeouts longer than the SLO allows. If the error budget is 43 minutes a month, a 30-minute first timeout spends most of it before a second person even hears about the problem.
- Escalating to the same person. If the secondary is the primary's phone in another app, there is no backup. Escalate to a different human.
- Escalating everything. Low-urgency alerts should not wake a manager. Give them a policy without escalation.
- Acknowledge and forget. Acknowledging stops escalation. Make sure acknowledged incidents still have an owner and get resolved.
How Vigil handles an escalation policy
- Each Vigil monitor can have an escalation: if its incident is not acknowledged within the minutes you set, Vigil alerts a second set of channels.
- On-call rotations with overrides and an ICS calendar feed decide who is on duty, and the on-call channel pages that person by email, SMS or phone call.
- Incidents can be acknowledged in the app, with Slack buttons or with the chat bot, and urgent Pushover alerts repeat until someone acknowledges them.
Escalation policy: frequently asked questions
How long should the first escalation timeout be?
Long enough to wake up and open a laptop, short enough to protect your SLO. Many teams use 5 to 15 minutes for urgent pages.
What is the difference between an escalation policy and an on-call schedule?
The schedule says who is on duty at a given time; the escalation policy says in what order people or schedules are notified and after how long.
Should escalation reach a manager?
As a last level, often yes, so an incident nobody handles reaches someone who can find help. It should be rare; if managers are paged often, the earlier levels need fixing.