The decision to escalate an incident should be based PRIMARILY on:

A. organizational hierarchy.
B. prioritization by the information security manager.
C. predefined policies and procedures.
D. response team experience.