Incident Response
Incident response is a leadership exercise under time pressure.
What good looks like
- triage quickly (scope, impact)
- stop the bleeding (rollback, disable feature)
- communicate clearly
- write a blameless postmortem with action items
A practical incident checklist
- Declare incident and assign roles
- Assess impact and user-facing symptoms
- Mitigate (rollback, failover, rate limit)
- Verify recovery
- Preserve data for analysis
- Postmortem and follow-ups
Postmortem quality bar
- timeline
- contributing factors
- what detection missed
- action items with owners and dates