Do you have a formal Incident Response Plan in place?

Yes, but without an escalation matrix. The Incident Response Plan defines actions to be taken in case of any security events.
As a small LLC, the implementation of formal escalation procedures is  unnecessary for QR Planet - communication between team members, supervisors, and relevant consultants happens naturally and directly. Management is always in the loop.