A security analyst informs the Chief Executive Officer (CEO) that a security breach has just occurred. This results in the Risk Manager and Chief Information Officer (CIO) being caught unaware when…

Procedure and policy management governs the creation and maintenance of organizational policies and procedures but does not specifically define the real-time communication and escalation workflows triggered during a security incident.

Chain of custody management is a forensic process for tracking and preserving evidence integrity during an investigation, not a stakeholder notification and escalation strategy.

Change management controls the process for making modifications to IT systems in a controlled manner and is unrelated to incident notification and escalation.

Incident management is the structured process for detecting, reporting, coordinating, and resolving security incidents, and it includes defined notification and escalation procedures. Implementing a formal incident management plan ensures that key stakeholders such as the Risk Manager and CIO are included in the communication chain from the moment an incident is detected, preventing senior leaders from being uninformed when questioned by the CEO.