Level 1, Level 2, Level 3 (L1, L2, L3) is one of the common ways to structure an escalation policy. The idea is simple: an incident triggers and lands with the first responder. If it needs more attention, it moves up the chain to someone with more expertise. This guide explains how each level works, when this structure makes sense, and what to keep in mind when setting one up.
Table of contents
What L1, L2, and L3 actually mean
L1, L2, and L3 are simply levels in the escalation chain. Here’s how teams think about them:
- L1 is the first contact. Usually an on-call responder who picks up the incident, triages it, and attempts a fix.
- L2 is someone with deeper system knowledge. Often a subject matter expert or senior engineer who steps in when L1 needs backup.
- L3 is the final escalation point. A manager or specialist who comes in if the incident is still unresolved after L2.
Most critical incidents get resolved at L1 or L2. And L3 is more of a safety net.
L1 doesn’t always have to mean junior. Some teams put their senior engineers at L1 because speed at the first step matters to them. Others use L1 as a learning position with a more experienced engineer at L2 as a backup. Both approaches work. The choice comes down to what your team is optimizing for.
When does the L1, L2, L3 escalation policy make sense?
L1, L2, L3 escalation policy makes sense when expertise varies across your team. A small team with a simple setup probably doesn’t need it. But once you have specialists who own specific services, a defined chain means they only get pulled in when the incident actually needs them.
What an L1, L2, L3 escalation policy actually looks like
Here are two examples showing how L1, L2, L3 escalation policy plays out.
For a high-priority incident:
- Step 1: Phone call to L1 (on-call responder)
If not acknowledged in 5 mins, move to level 2 - Step 2: Phone call to L2 (subject matter expert or senior engineer)
If not acknowledged in 5 mins, move to level 3 - Step 3: Phone call to L3 (engineering manager)
For a low-priority incident:
- Step 1: Email to L1 (on-call responder)
If not acknowledged in 2 hours, move to level 2 - Step 2: Email to L2 (subject matter expert or senior engineer)
If not acknowledged in 2 hours, move to level 3 - Step 3: Mobile notification to L3 (engineering manager)
In both cases, the incident moves through L1, L2, and L3 in the same order. What changes is how urgently it moves and how it reaches each person.
In Spike, you can set up an L1, L2, L3 escalation policy in less than 2 minutes. And updating it later is just as quick.
What happens if nobody responds at L3
It’s worth deciding this before the policy goes live. Here’s how you can handle it in one of two ways.
Option one is to loop the incident back to L1 and start the chain again. This makes sense when the no-response was likely a timing issue rather than a sign that the incident is beyond the team’s capacity.
Option two is to open a broader response. A dedicated Slack channel, a group call, or a message to the wider team. This makes more sense when the incident has already been through the full chain without resolution and clearly needs more hands.
Either approach is fine. The important thing is that the policy has a clear answer rather than leaving it open-ended.
FAQs
How often should we review our L1, L2, L3 policy?
A good time to review is after a significant incident or when the team composition changes. If incidents are regularly reaching L3 before getting resolved, that’s a signal worth paying attention to. It usually means something in the chain needs adjusting, whether that’s the wait times, the people at each level, or both.
What happens to an incident once L2 or L3 acknowledges it?
The escalation chain stops as soon as someone acknowledges. The incident stays with that person until it’s resolved. If you want a safety net for incidents that get acknowledged but never closed, Spike’s Resolve by Timer can help. It automatically resolves an incident after a set duration, so stale incidents don’t linger on your dashboard or block new alerts from the same source.
How does an L1, L2, L3 policy interact with on-call schedules?
The two work closely together. An on-call schedule decides who is responsible for incidents during a given period. The escalation policy decides what happens when that person doesn’t respond. L1 in the policy often points to whoever is currently on-call rather than a fixed person. That way, the two stay in sync automatically.