# Incident Response Playbook > Guides the developer-side incident lifecycle from triage through mitigation to blameless RCA — with severity classification, Slack update templates, escalation paths, and a structured post-mortem format. Use when a production issue is active or... - Skill: `newkayak12/incident-response-playbook` (Agent Skill) - Install (CLI): `npx skillmds@latest add newkayak12/incident-response-playbook` - Raw SKILL.md: https://api.skillmd.com/api/skills/newkayak12/incident-response-playbook/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Integrations & APIs - Author: newkayak12 (https://skillmd.com/u/newkayak12) - Updated: 2026-09-21 - Page: https://skillmd.com/skills/newkayak12/incident-response-playbook --- ## Standing Mandates - ALWAYS classify severity before any other action — severity drives escalation and communication cadence. - ALWAYS separate mitigation (restore service) from investigation (find root cause) — do not block one on the other. - NEVER assign blame to individuals in post-mortems — focus on systemic factors. - NEVER skip the timeline reconstruction step in RCA; gaps in the timeline are often the cause. # Incident Response Playbook Speed matters. Clarity matters more. Blame solves nothing. --- ## Incident Lifecycle ``` Detect → Triage → Communicate → Mitigate → Resolve → Learn ``` Each phase has a clear exit condition. Do not skip phases under pressure. --- ## Severity Classification | Severity | Definition | Response Time | Example | |----------|-----------|---------------|---------| | **P0** | Full service down; all users affected; revenue/data at risk | Immediate — page on-call now | Checkout API 100% error rate | | **P1** | Major feature broken; significant user subset affected | < 15 min | Payment processing failing for 30% of users | | **P2** | Degraded performance or partial feature failure | < 1 hour | Search latency 10x normal; some timeouts | | **P3** | Minor issue; workaround available; low user impact | Next business day | Dashboard chart missing for 5% of users | **Escalate up, not down.** When in doubt, treat as higher severity. --- ## Phase 1 — Detect Sources of detection (in order of reliability): 1. Automated alert (PagerDuty, OpsGenie, CloudWatch alarm) 2. Synthetic monitor / uptime check failure 3. User report via support ticket or social media 4. Team member notices in logs or dashboard **First action on detection**: open an incident channel immediately, even if you're still diagnosing. --- ## Phase 2 — Triage (target: < 5 min for P0/P1) Answer these questions fast: 1. **What is broken?** (service, endpoint, feature) 2. **Who is affected?** (all users / subset / internal only) 3. **When did it start?** (check deploy history, config changes, upstream alerts) 4. **What changed recently?** (deployments, feature flags, infra changes, dependency updates) 5. **What is the blast radius?** (data corruption? revenue loss? SLA breach?) **Triage output**: severity classification + incident commander assigned. --- ## Phase 3 — Communicate ### Rule: communicate before you know the answer. Silence is worse than "we're investigating." Update every 15–30 min for P0/P1. ### Internal Slack Update Template ``` [P0] - Status: Investigating / Identified / Mitigating / Resolved Impact: Start time: Last update: IC: @ Bridge: Next update: ``` ### Status Page Update Template ``` Investigating: We are aware of an issue affecting . Our team is actively investigating. We will provide an update by