Incident Response Checklist

Use when a customer-facing or business-critical incident starts. Confirm impact before you chase root cause.

First minutes

1. 1Confirm the incident and state the customer impact in plain language.
2. 2Assign severity from impact, not from how interesting the bug looks.
3. 3Page the service owner and a backup.
4. 4Acknowledge ownership in the incident record.
5. 5Open one shared incident channel or record.
6. 6Name an Incident Commander for major incidents.

Mitigate and communicate

1. 7Check recent deploys, flags, config, traffic, and vendor notices.
2. 8Follow the relevant runbook.
3. 9Choose the safest mitigation: rollback, failover, disable, route away, or scale.
4. 10Update support, leadership, and other affected internal teams.
5. 11Publish a customer update once impact is confirmed. Do not wait for root cause.

Recover and learn

1. 12Validate recovery on the actual user path, not only infrastructure graphs.
2. 13Close only after service is stable and stakeholders have been updated.
3. 14Preserve the timeline, identifiers, and evidence.
4. 15Run a postmortem when required.
5. 16Give every corrective action an owner, a due date, and a trackable task.
6. 17Check that those actions are completed.
7. 18Update runbooks, alerts, and ownership records from what you learned.