| name | incident-response |
| description | Standard operating procedures for production incident management including severity classification, escalation paths, communication protocols, and postmortem processes. |
Incident Response
This skill provides structured guidance for handling production incidents.
When to Declare an Incident
An incident should be declared when:
- A production service is degraded or unavailable for users
- Data integrity may be compromised
- A security breach is suspected
- SLA thresholds are at risk of being violated
Roles
| Role | Responsibility |
|---|
| Incident Commander (IC) | Owns the incident lifecycle, coordinates response, makes decisions |
| Communications Lead | Keeps stakeholders informed, posts status updates, manages the incident channel |
| Technical Lead | Drives root cause investigation, coordinates engineering fixes |
General Triage Steps
- Acknowledge - Confirm you are responding to the alert
- Assess - Determine severity using the severity-levels reference
- Communicate - Open an incident channel and notify stakeholders
- Escalate - Follow the escalation policy based on severity
- Mitigate - Apply immediate fixes to restore service
- Resolve - Confirm the issue is fully resolved and monitoring is clean
- Postmortem - Schedule and complete a blameless postmortem within 48 hours
Communication Expectations
- Status updates every 15 minutes for SEV1, 30 minutes for SEV2
- All communication happens in the incident Slack channel
- External customer communication is handled by the Communications Lead
- Management is notified per the escalation policy
Available References
severity-levels.md - Severity definitions (SEV1-SEV4) with impact and response timesescalation-policy.md - Who to page per severity level and escalation timelinespostmortem-template.md - Structured template for blameless postmortems
Available Scripts
page-oncall.sh - Page the on-call engineer via PagerDuty APIcreate-incident-channel.sh - Create a dedicated Slack incident channel
Available Assets
escalation-flowchart.mermaid - Visual flowchart of the escalation process
