IRP — Incident Response Plan

Purpose

Generates an Incident Response Plan specific to the product/platform. Not a generic IT incident template — this plan is scoped to the product, uses its real stakeholders as escalation contacts, and ties severity to its data classification.

Process

Step 1: Read Context

Read all that exist:

• CLAUDE.local.md — architecture, stakeholders, vendor contacts, data classification
• PRD/*.html or PRD/*.md — security section, RBAC, NFRs, integrations
• Data/Stakeholder-Directory.* — escalation contacts with roles and emails
• Operational/DR-Plan*.html — recovery procedures to reference (if exists)

Step 2: Ask Discovery Questions

Only ask what can't be inferred: