At 2:14am a guard finds a forced door at a client's warehouse. He knows what he is looking at. He does not know who to wake, or which of the two numbers on the post order still works. A security escalation matrix removes that hesitation.

An escalation matrix is one page saying, for each severity level, who gets told, how fast, by what method, and who to try when the first person does not answer. Build it around four levels, put a named backup behind every primary, and rehearse the paths. The times below are a starting template. Set yours against what your client contract promises.

Nothing in this template overrides your post orders, your client's own emergency plan, or the law where you operate. Call 911 first for anything life-threatening. Everything after that is sequencing.

How should severity levels be defined?

The definitions have to be usable by a guard at 2am with adrenaline up. Write them so the level is obvious from the incident, not from a judgment call.

Level	Definition	Examples
Critical (1)	Immediate threat to life, major property damage, or significant business disruption	Active threat, fire, bomb threat, serious injury, major theft in progress
High (2)	Security breach needing immediate response, with room to get worse	Unauthorized entry to a secure area, aggressive individual, significant vandalism, utility failure
Medium (3)	Needs prompt attention, no immediate threat	Suspicious activity, minor theft discovered, parking disputes, non-violent trespasser
Low (4)	Routine, needs documenting and follow-up	Lost property, visitor complaints, minor policy violations, maintenance issues

The line that causes the most trouble in practice is between High and Medium. Settle it with a rule rather than adjectives: if leaving it alone for an hour could make it worse, it is High.

How fast does each level have to move?

These are the intervals operators commonly write into a matrix. Treat them as a default you then reconcile against your service agreement, because a contract that promises a 30-minute callback and a matrix that says one hour is a dispute waiting to happen.

Severity	Initial response	Supervisor notified	Management notified
Critical	Immediate	Within 5 minutes	Within 15 minutes
High	Within 5 minutes	Within 15 minutes	Within 1 hour
Medium	Within 15 minutes	Within 1 hour	End of shift or next business day
Low	Within 30 minutes	Daily summary	Weekly report

Whatever numbers you land on, they need to match what you sold. Pull the response-time language out of your service agreement and put it side by side with this table before you publish either.

Who gets called, in what order?

Critical incidents (Level 1)

FIRST: call 911 for anything life-threatening. Nothing in the chain below happens before that call.

Order	Contact	Method	Backup
1	Security dispatch	Radio channel 1	Phone: [number]
2	Security supervisor	Phone or radio	[backup supervisor]
3	Security director	Phone	[assistant director]
4	Facility manager	Phone	[backup FM]
5	Client contact (contract sites)	Phone	[secondary contact]
6	Executive management	Phone	[per protocol]

Order matters less than the backups. A matrix with six primaries and no alternates fails the first time someone is on a plane. Every row gets a second name.

High severity (Level 2)

Order	Contact	Method	When
1	Security dispatch	Radio	Immediately
2	Security supervisor	Phone or radio	Within 15 min
3	Security director	Phone or email	Within 1 hour
4	Facility manager	Phone or email	Within 1 hour, business hours

Medium severity (Level 3)

Order	Contact	Method	When
1	Security dispatch	Radio or app	Within 15 min
2	Security supervisor	Email or app	Within 1 hour
3	Security director	Email	End of shift

Low severity (Level 4)

Contact	Method	When
Log the entry	Daily activity report	Within shift
Security supervisor	Daily summary	Next business day

Level 4 is where matrices quietly rot. Nobody escalates, so nobody checks whether the log entry was written, and six months later a pattern of small thefts turns out to have been visible the whole time. The discipline is in writing the entry properly, not in the call.

What are the incident-specific sequences?

Medical emergency

Call 911.
Radio dispatch for the AED and additional officers.
Notify the supervisor.
Send an officer to meet EMS at the entrance. This is the step that gets skipped, and it costs minutes at the door.
Notify the facility manager if it is business hours.
Family notification follows the client's policy. On most contracts it is not the guard's call.

For a suspected poisoning or chemical exposure, Poison Control is free and confidential at 1-800-222-1222. Put the number on the post order, not just in a binder.

Fire or evacuation

Pull the alarm, call 911.
Radio dispatch and all units.
Begin evacuation per the site plan.
Notify the supervisor and director.
Notify the facility manager.
Hand off to the fire department incident commander on arrival, with a headcount and the location of anyone unaccounted for.

That last step is where a private security team either helps or gets in the way. Knowing how the command structure works before you are standing in it is the point of learning ICS as a security team.

Active threat

Call 911. Give location, description, weapon type.
Radio dispatch with your site's code and the location.
Implement lockdown if the site has one.
Direct people away from the threat.
Supervisor and director notified immediately.
Meet law enforcement and hand over what you know, including camera locations.

This is the one sequence you should train rather than distribute. CISA publishes free active shooter preparedness training and resources, and running the site's plan against them once a year is cheap.

Theft or burglary, discovered

Secure the scene. Touch nothing.
Radio dispatch.
Call police for a report number.
Notify the supervisor.
Notify the security director and the client.
Preserve the video before the recorder overwrites it. Most systems loop in days, not weeks, and this step has a deadline nobody puts on the sheet.

What contacts belong on the sheet?

Print this filled in, laminate it, and put a copy at every post. The version on a shared drive is the version nobody can reach when the network is the thing that failed.

Category	Contact	Number
Emergency	Police, fire, EMS	911
Emergency	Police non-emergency	[local number]
Emergency	Fire non-emergency	[local number]
Emergency	Poison Control	1-800-222-1222
Chain of command	Dispatch	[radio channel and phone]
Chain of command	Shift supervisor	[name and number]
Chain of command	Security director	[name and number]
Chain of command	Director backup	[name and number]
Facility	Facility manager	[name and number]
Facility	Building engineer	[name and number]
Facility	After-hours maintenance	[number]
Utilities	Electric	[number]
Utilities	Gas	[number]
Utilities	Water	[number]
Client	Primary	[name and number]
Client	Secondary	[name and number]
Client	After-hours	[number]

Which channel for which message?

Method	Use for	Why
Radio	Immediate tactical traffic	Instant, and everyone on the channel hears it
Phone call	Direct notification, anything sensitive	Confirms receipt and allows questions
Text	Quick notice at low urgency	Written record, does not interrupt
Email	Detail, attachments, documentation	Audit trail
App notification	Routine updates and shift information	Logged and timestamped automatically

One rule overrides the table: a Critical notification is not delivered until a human acknowledges it. A text nobody read is not a notification, and "I sent it" is not a defense when the client asks why they found out at 8am.

How do you keep the matrix from going stale?

Review quarterly, and immediately after any personnel change. A wrong number is worse than no matrix, because it consumes the minute you needed.

Test the paths once a year. Actually dial the after-hours numbers. You will find two dead ones.

Version the sheet with a date, and pull the old copies off the posts when you distribute a new one.

Fold it into the post orders for each site rather than keeping a separate document that drifts.

Cover it at shift handoff whenever it changes, so the night crew is not reading last quarter's version.

A matrix is one artifact in a larger set. If you are building the rest, the incident response playbook covers what happens after the call connects, and the emergency quick reference is what actually goes in the guard's pocket.

Key Takeaways

Four severity levels, defined so a guard can pick one under stress, not by adjectives.
Response times in the matrix must match the response times in the client contract.
Every primary contact gets a named backup. Chains without alternates fail on the first vacation.
A Critical notification is not complete until someone acknowledges it.
Dial the after-hours numbers once a year. Stale numbers are the usual failure.