---
title: Incident Response Framework
tags: [incident, response, framework, sev, runbook]
owner: sre
updated: 2026-06-20
---

# Incident Response Framework

## Severities

- **SEV1**: total outage. Page on-call. Mitigate first, post-mortem after.
- **SEV2**: significant degradation. Ticket + stakeholder communication.
- **SEV3**: minor impact. Normal ticket.

## Steps

1. **Detect**: automatic alert or report.
2. **Triage**: identify scope and severity.
3. **Mitigate**: apply runbook or workaround before the root-cause fix.
4. **Communicate**: status page and stakeholders every 30 min for SEV1.
5. **Resolve**: apply the root-cause fix.
6. **Post-mortem**: blameless, within 5 business days.

## Roles

- Incident Commander
- Communications Lead
- Subject Matter Expert

## Related webhooks

- service-restart
- dns-flush
- disk-cleanup
- log-tail