Opens in a new tab

3 steps · Incident response

Prepare an incident response

Draft a runbook, work through an example and record the gaps to resolve.

BringA service owner, a known failure scenario, escalation contacts and recovery criteria.

Finish withA runbook draft with an exercise record and an action list for the gaps it exposed.

  1. Step 1

    Draft the procedure

    Choose a known failure in one service. The builder connects its symptom with access requirements, diagnostic branches, mitigation and escalation; the examples show how those parts fit together.

    Before moving on: Replace the example’s service details with the intended procedure, while retaining the practice-data label for the rehearsal.

    Open builderView worked example

    Save a file draft so you can reopen and revise it during the exercise.

  2. Step 2

    Rehearse the response

    Walk through the procedure in a practice scenario and record when the responder notices the symptom, begins investigating and attempts each mitigation. If they stop to find access or interpret an instruction, note that too. Those notes explain the waiting that timestamps alone cannot.

    Before moving on: The timestamps describe this exercise. Keep them marked as practice so a later report does not mix them with production incident measurements.

    Open calculatorView worked example

    Use Save file draft to keep the editable timeline and retain the full exported report before leaving. Prepare next draft carries only incident notes and a timing summary into the action tracker, not the milestone timestamps, evidence or mitigation-attempt rows. Open and review the transferred summary in the same browser tab.

  3. Step 3

    Assign the readiness gaps

    Turn the points where the rehearsal stalled into actions: unavailable access, an ambiguous branch or a recovery check that could not be performed. Each action needs someone responsible for resolving that specific gap.

    Before moving on: Repeat the step that stalled in rehearsal after the action is delivered. The verification result should show what now lets the responder continue, rather than only confirming that a document or access request was completed.

    Open trackerView worked example

    Download and keep the action register. A selected action can transfer its scenario, proposed change, owner, test and evidence into a runbook draft, but not its due date, status or remaining exposure. Review the transfer and add any relevant unresolved exposure yourself. It does not create an exercise sign-off.