In an SLA breach response, which action is typically performed after immediate containment?

• A. Notify Stakeholders
• B. Incident Escalation
• C. Root-Cause Analysis
• D. Update SLA to Reflect Improvements

Answer: (B)

After immediate containment, the next step is to escalate the incident to the appropriate owners and escalation path. This move commits the right people and resources, sets the incident’s priority, and ensures decisions are made quickly to drive restoration and prevent further impact. Escalation unlocks coordinated remediation and clear accountability, which is why it’s the best fit for what happens next.

Notifications to stakeholders and broader communications often occur once escalation is in motion or as the incident is prioritized, but they aren’t the immediate action that unlocks the response. Root-cause analysis typically follows containment and initial remediation, to understand why it happened and prevent recurrence. Updating the SLA to reflect improvements happens after the incident is resolved and a post-incident review is complete.