# Incident Response

Incident response is a leadership exercise under time pressure.

## What good looks like

- triage quickly (scope, impact)
- stop the bleeding (rollback, disable feature)
- communicate clearly
- write a blameless postmortem with action items

## A practical incident checklist

1. Declare incident and assign roles
2. Assess impact and user-facing symptoms
3. Mitigate (rollback, failover, rate limit)
4. Verify recovery
5. Preserve data for analysis
6. Postmortem and follow-ups

## Postmortem quality bar

- timeline
- contributing factors
- what detection missed
- action items with owners and dates