incident-response

Installation
SKILL.md

Incident Response

Severity Levels

Assign a severity level immediately upon incident detection. Severity determines response urgency, communication cadence, and escalation path.

Severity Name Description Examples Response Time Update Cadence Responders
P0 Total Outage Complete service unavailability. All users affected. Revenue-impacting. Site completely down, data corruption, security breach with active exploitation < 15 minutes Every 15 minutes All hands on deck, executive notification
P1 Major Degradation Core functionality severely impaired. Large portion of users affected. Payment processing broken, authentication failing for most users, major data pipeline stalled < 30 minutes Every 30 minutes On-call engineer + team lead, stakeholder notification
P2 Partial Impact Non-core functionality broken or core functionality degraded for a subset of users. Search feature down, slow responses in one region, intermittent errors for some users < 2 hours Every 2 hours On-call engineer
P3 Minor Issue Cosmetic issues, minor bugs, or issues with workarounds available. UI glitch, non-critical background job delayed, minor data inconsistency Next business day Daily (if ongoing) Assigned engineer

Escalation Rules

  • If a P2 is not resolved within 4 hours, escalate to P1.
  • If a P1 is not resolved within 2 hours, escalate to P0.
  • Any incident involving data breach or security compromise is automatically P0.
  • When in doubt, over-classify. It is better to downgrade than to under-respond.
Related skills
Installs
3
GitHub Stars
7
First Seen
Feb 26, 2026