Run Incident Response

Stabilize first. Communicate observed facts, actions underway, and the next update time. Keep estimates labeled as estimates. Keep security-sensitive and personal data in authorized incident channels.