Incident Response
Prioritize safety and service restoration over root-cause completeness during an active incident.
Active Incident
- Record start time, reporter, affected users, symptoms, severity, and known scope.
- Assign or identify incident lead, operations owner, and communication owner when a team is involved.
- Preserve evidence and establish reliable health signals.
- Contain impact with the smallest reversible mitigation: disable, rollback, isolate, rate-limit, or fail over as authorized.
- Verify recovery from user-facing and system signals; continue monitoring through a defined stability window.
- Maintain a timestamped timeline of decisions, commands, changes, and outcomes.
Production mutations, customer communications, rollbacks, and failovers require explicit authorization unless an established runbook grants it.
Follow-up
Document impact, root cause, contributing factors, detection gaps, what helped, what delayed recovery, and owned actions with deadlines. Keep the review blameless and focus on system improvements.
1---2name: incident-response3description: Coordinate production incident diagnosis, mitigation, communication, recovery verification, timeline capture, and blameless follow-up.4---56# Incident Response78Prioritize safety and service restoration over root-cause completeness during an active incident.910## Active Incident11121. Record start time, reporter, affected users, symptoms, severity, and known scope.132. Assign or identify incident lead, operations owner, and communication owner when a team is involved.143. Preserve evidence and establish reliable health signals.154. Contain impact with the smallest reversible mitigation: disable, rollback, isolate, rate-limit, or fail over as authorized.165. Verify recovery from user-facing and system signals; continue monitoring through a defined stability window.176. Maintain a timestamped timeline of decisions, commands, changes, and outcomes.1819Production mutations, customer communications, rollbacks, and failovers require explicit authorization unless an established runbook grants it.2021## Follow-up2223Document impact, root cause, contributing factors, detection gaps, what helped, what delayed recovery, and owned actions with deadlines. Keep the review blameless and focus on system improvements.
egeetas