incident-response-runbook

An incident response runbook must be written so responders can execute it under pressure without prior context. It structures severity ladders with one-minute criteria, defines role collapse for small teams, triages alerts to containment decisions, and enforces postmortem finding dispositions.

A severity ladder classifies production incidents from SEV1 to SEV4 using objective one-minute criteria with concrete examples. The core rule is that ambiguity classifies up, ensuring responders quickly escalate uncertain situations rather than underestimating impact during triage.

Incident communication requires specifying incident commander, comms lead, and operations responsibilities with severity-based update cadences. Tenant-aware disclosure ensures affected tenants receive appropriate status page updates while small-org role collapse behavior keeps comms flowing without requiring a dedicated team.

Postmortem discipline requires capturing evidence during the incident and ensuring every finding lands in a named outcome such as a regression test, alert fix, runbook fix, architecture item, or owned accepted risk. This enforced disposition prevents unresolved findings from recurring.

Yes, the runbook explicitly handles small-org role collapse behavior where the same responder must cover incident commander, comms, and operations duties. It structures containment guidance to triage alert families to decision points and references rollback procedures by reference rather than reauthoring them.

Runbooks fail when they lack objective one-minute SEV criteria, reference containment procedures without reauthoring them, or omit evidence capture during the incident. Without enforced finding dispositions and tenant-aware disclosure, responders improvise inconsistently instead of following executable, stress-tested procedures.