incident-response

name	incident-response
description	Provides incident response best practices covering severity classification, on-call rotation, war room protocols, runbook templates, escalation policies, and blameless postmortems. Use when handling an incident, setting up on-call, writing a postmortem, creating a runbook, configuring PagerDuty or OpsGenie, or building incident management processes.
type	skill
category	ops
status	stable
origin	tibsfox
modified	false
first_seen	"2026-02-07T00:00:00.000Z"
first_path	examples/incident-response/SKILL.md
superseded_by	null

Incident Response

Incidents are inevitable in any production system. The difference between a minor blip and a catastrophic failure is how prepared your team is to detect, respond, communicate, and learn. This guide covers the full incident lifecycle from classification through postmortem, with concrete templates and integration patterns.

Severity Classification

Every incident must be classified immediately. Severity determines response speed, communication cadence, and escalation paths.

Severity	Impact	Examples	Response Time	Duration Target
SEV1	Complete outage or data loss	Service down for all users, data corruption, security breach	5 min	Mitigate < 1 hour
SEV2	Major degradation	Core feature broken for >10% users, payment failures	15 min	Mitigate < 4 hours
SEV3	Minor degradation	Non-critical feature broken, elevated error rate	1 hour	Resolve < 24 hours
SEV4	Cosmetic or low impact	UI glitch, misleading error message	Next business day	Resolve < 1 week

Classification Decision Tree

Is the service completely unavailable to all users? -> SEV1
Is there a security breach or data exposure?        -> SEV1
Is there data loss or corruption?                   -> SEV1
Is a core revenue feature broken for >10% users?    -> SEV2
Is there financial impact (failed payments)?        -> SEV2
Is a core feature broken for <10% users?            -> SEV3
Is it a non-critical feature degradation?           -> SEV3
Everything else                                     -> SEV4

On-Call Setup

Component	Recommendation	Rationale
Rotation size	5-8 engineers minimum	Allows 1-week shifts with recovery time
Shift length	1 week (Mon 09:00 to Mon 09:00)	Predictable, long enough for context
Primary + Secondary	Always two people on call	Backup for escalation or unavailability
Handoff meeting	30 min at rotation start	Review active issues, recent changes, known risks
Follow-the-sun