Last updated: 2026-07-19
Alert Escalation Policy Template
Define who gets alerted, when, and through which channel. A clear escalation policy prevents alert fatigue and ensures critical issues reach the right person.
Use this template to create an alert escalation policy for your team. Covers on-call rotations, escalation tiers, notification channels, and quiet hours to prevent burnout.
Escalation tiers
Tier 1 (immediate): the primary on-call engineer receives an alert via PagerDuty. They have 5 minutes to acknowledge. If unacknowledged, escalate to Tier 2. Tier 2 (5 minutes): the secondary on-call engineer and the engineering manager receive alerts. They have 10 minutes to acknowledge. Tier 3 (15 minutes): the CTO and VP of Engineering receive alerts. This tier should almost never fire. If it does, the incident is a SEV1 by definition.
On-call rotation
Weekly rotation: the primary on-call engineer changes every Monday at 10 AM. Handoff happens in the team's Slack channel with a summary of any open incidents and known issues. Everyone on the team participates in rotation. New team members shadow for 2 weeks before joining the rotation. The rotation schedule is published in a shared calendar visible to the whole company.
Notification channels
PagerDuty: primary alert channel for all tiers. Push notifications, phone calls, and SMS. Slack: #incidents channel gets all alert notifications (for visibility, not primary alerting). Email: backup channel for Tier 3 escalations. Phone call: reserved for SEV1 incidents that reach Tier 3 without acknowledgment.
Quiet hours and alert suppression
Non-critical alerts are suppressed from 10 PM to 7 AM in the on-call engineer's timezone. Critical alerts fire 24/7. During quiet hours, non-critical alerts are logged and delivered as a summary at 7 AM. Alert suppression does not apply to SEV1 incidents, SSL certificate expiration warnings (which have a 30-day lead time), or heartbeat failures (which could indicate data loss).
- Define 3 escalation tiers with acknowledgment timeouts
- Set up weekly on-call rotation with Monday handoff
- Configure PagerDuty as primary alert channel
- Route alerts to Slack #incidents for team visibility
- Set quiet hours: suppress non-critical alerts 10 PM to 7 AM
- Define exceptions: SEV1, SSL expiry, and heartbeat failures always fire
- Document escalation policy in team wiki
- Review policy quarterly and after every SEV1 incident
Frequently asked questions
How do I prevent alert fatigue?
Alert fatigue happens when too many alerts fire, and people start ignoring them. Fix it in three steps: increase alert thresholds (3 failures instead of 1), suppress non-critical alerts during quiet hours, and regularly review which monitors are alerting most often. If a monitor fires more than once a week for transient issues, fix the underlying cause or increase its threshold.
What if no one acknowledges an alert?
The escalation policy handles this. If Tier 1 does not acknowledge within 5 minutes, Tier 2 gets paged. If Tier 2 does not acknowledge within 10 minutes, Tier 3 gets paged. If Tiers 1-3 all fail (extremely rare), the incident is logged and the team reviews what went wrong in the post-mortem. If this happens more than once, the escalation policy needs to be revised.
Should I use PagerDuty or can Slack alerts work?
Slack is great for visibility but terrible for alerting. Notifications get lost in busy channels, Do Not Disturb settings suppress them, and there is no acknowledgment or escalation mechanism. Use PagerDuty (or a similar tool) for primary alerting. Use Slack as a secondary visibility channel so the whole team can see what is happening.