incident-management
Incident Management
Implement effective incident management processes including severity definitions, escalation matrices, war room procedures, and blameless post-mortem templates.
When to Use
- Establishing incident management processes for production systems
- Defining severity levels and escalation procedures
- Running war rooms and coordinating incident response
- Conducting blameless post-incident reviews
- Building on-call schedules and notification workflows
- Meeting compliance requirements for incident response (SOC 2, HIPAA, PCI DSS)
Severity/timing/staffing numbers are example policy, not universal compliance requirements. Classify security/privacy impact independently of availability and invoke the authorized security/legal response path when needed. Do not wait for a service-wide outage or a timer before escalating suspected compromise.
Creating channels, paging people, publishing status/customer notices and changing production require the user's authorized incident scope and designated owner. Drafts are not sent notifications. Preserve evidence and restricted/redacted logs before destructive recovery when feasible; containment and safety may take priority over restoration. State confirmed impact separately from hypotheses, use UTC plus dates, and verify both service recovery and security containment before closure.