When developing incident response procedures involving servers hosting critical applications, which of the following should be the FIRST to be notified? 

Answer options:

A. Business management
B. Operations manager
C. Information security manager
D. System users

C

The escalation process in critical situations should involve the information security manager as the first contact so that appropriate escalation steps are invoked as necessary. Choices A, B and D would be notified accordingly.