What Good Incident Response Looks Like

I've been involved in more incident responses than I care to think about, responding to service outages, compromises and serious vulnerabilities. I've operated in slack channels, on bridge calls and in person. Over the course of my career, I've also trained and mentored others on what good incident response is supposed to look like. Effective incident response is often much less about how the issue gets resolved than it is about the communication and discipline that helps drive to that resolution. I was recently prompted to dig out some old notes and slides, so I decided to merge them into a post at the same time. Contents Contents Declaring An Incident Primary Mission: Remove or Reduce Impact Secondary Mission: Preserve Focus Preserve Timeline Compromises Communication Customers Who Communicates? Suggested Communication Structure Internal Incident Comms Incident Commanders: Ensure Ownership Metrics Post-Mortems Keep Process Short 2026 Update: AI Communication/Handovers Post-Mortems…