Incident Response

---
name: incident-response
description: "Run an incident and learn from it: declare + classify severity, split IC/comms/ops roles, communicate on a cadence, mitigate before root-causing, and write a blameless postmortem with owned, dated action items."
---

# Incident Response

**Purpose:** respond fast, communicate clearly, learn permanently.

## Declare & classify
Lean toward declaring. Severity sets the response size.

## Roles (separate them)
- **IC** — coordinates, decides, does NOT debug.
- **Ops** — fixes.
- **Comms** — updates stakeholders on a cadence.

## Mitigate first
Rollback / failover / flag-off to stop bleeding **before** forensic root-cause.

## Blameless postmortem
Fix the **system** that let the human err. Timeline + contributing factors + **owned, dated** action items tracked to done.