incident-management

1# Incident Management
2 
3Implement effective incident management processes including severity definitions, escalation matrices, war room procedures, and blameless post-mortem templates.
4 
5## When to Use
6 
7- Establishing incident management processes for production systems
8- Defining severity levels and escalation procedures
9- Running war rooms and coordinating incident response
10- Conducting blameless post-incident reviews
11- Building on-call schedules and notification workflows
12- Meeting compliance requirements for incident response (SOC 2, HIPAA, PCI DSS)
13 
14## Severity Levels
15 
16```yaml
17severity_definitions:
18  SEV1_critical:
19    impact: "Complete service outage or data breach affecting all/most customers"
20    examples:
21      - Production site completely down
22      - Data breach confirmed or suspected
23      - Complete loss of a critical business function
24      - Security incident with active exploitation
25    response_time: "Immediate (within 5 minutes)"
26    update_frequency: "Every 15-30 minutes"
27    who_is_paged: "On-call engineer, engineering manager, incident commander, executive on-call"
28    communication: "Status page update, customer email, executive notification"
29    resolution_target: "< 1 hour to mitigate"
30 
31  SEV2_major:
32    impact: "Major feature broken or severe degradation affecting many customers"
33    examples:
34      - Key feature completely non-functional
35      - Significant performance degradation (>5x latency)
36      - Data processing pipeline completely stalled
37…