Escalation policy

An escalation policy is the ordered list of steps that decides who is alerted about an incident, through which channel, and after how long. If nobody acknowledges or fixes the problem, the alert moves to the next step: a chat message, then a text, then a phone call, then a second person.

Hyperping escalation policy with a Telegram step right away, then a phone call, Telegram, and SMS three minutes later

In Hyperping, an escalation policy is a list of steps, each with a delay and one or more channels: email, SMS, phone call, Slack, Microsoft Teams, or any connected integration. A delay of 0 fires as soon as the outage is confirmed, and each later delay counts from the previous step. For email, SMS, and phone calls, a step can target an on-call schedule instead of a person. The steps keep running until the outage resolves, and acknowledging stops the repeat alerts without cancelling the escalation, so a long outage still reaches a second responder.

An example policy

  1. Immediately: a message in the team's #incidents Slack channel. Anyone can acknowledge from there.
  2. After 5 minutes: an SMS to whoever is on call.
  3. After 10 more minutes: a phone call to the on-call engineer and an email to the team.
  4. After 15 more minutes: a phone call to the engineering lead.

When the monitor recovers, the steps that haven't fired yet are cancelled.

Designing escalation policies

  • Use more than one policy. Revenue-critical services get the full chain with phone calls. A marketing site or a staging environment goes to chat only, and nobody's phone rings for the blog.
  • Escalate across channels before people. A missed Slack message is more likely than an absent engineer, so try SMS and a call before paging a second person.
  • Keep delays short at night. Five minutes before an SMS is reasonable, thirty is an outage nobody handled.
  • End with a person who will answer. The last step should reach someone senior, not a shared inbox.
  • Test the policy with a monitor pointing at a 404 page before you rely on it.

Escalation policy vs on-call schedule

The on-call schedule answers "who is responsible right now?". The escalation policy answers "how do we reach them, and who's next if we can't?". Policies reference schedules, so swapping a shift changes who gets paged without touching the policy.

How to create one in Hyperping

  1. Go to Escalation Policies and create a policy with a descriptive name, such as "Production critical".
  2. Set the first step's delay and channels, then add more steps with + Add another escalation step.
  3. For SMS and phone call steps, pick an on-call schedule as the recipient.
  4. Optionally set alert grouping on the policy, so several monitors failing together send one alert.
  5. Assign the policy to monitors from their Notifications tab. See escalation policies in the docs.

FAQ

How long should I wait before escalating?

Five minutes between the first notification and the next channel, and 10 to 15 minutes before paging a second person. Longer delays add directly to your MTTA.

What happens when someone acknowledges the alert?

In Hyperping, the outage is marked as owned and the repeat alerts stop. The remaining steps still run until the outage resolves, so managers hear about long outages.

Do I need an escalation policy with a small team?

Yes, a short one. Even two people benefit from "Slack first, then a phone call after 5 minutes", because it turns a missed message into a ringing phone.

Related Terms

On-call
Being on call means being the person responsible for responding to production alerts during a set pe...
On-call rotation
An on-call rotation is the schedule that decides which team member is on call during each period, an...
Alert routing
Alert routing decides where each alert goes: which person, team, or channel receives it, based on th...
MTTR (mean time to recovery)
MTTR, or mean time to recovery, is the average time it takes to restore a service after a failure. D...
Incident severity
Incident severity is a level, such as SEV1 to SEV4 or critical, major, and minor, that ranks an inci...
Alert fatigue
Alert fatigue is what happens when responders receive so many alerts, most of them false or unimport...

Related Resources

Get started

Start monitoring in the next 5 minutes.

Stop letting customers discover your outages first. Set up monitoring, status pages, on-call, and alerts before your next coffee break.

Free plan, 20 monitors. No credit card, no time limit.