Incident Management Procedure

Severity Levels

Severity	Meaning	Response
SEV1	Critical outage or security compromise	Immediate mitigation and postmortem
SEV2	Major degraded service or contained security event	Same-day mitigation
SEV3	Localized issue with workaround	Planned remediation
SEV4	Minor issue or documentation gap	Backlog with owner

Triage Flow

flowchart TD
  alert[Alert fires] --> classify[Classify severity]
  classify --> stabilize[Stabilize service]
  stabilize --> evidence[Preserve evidence]
  evidence --> communicate[Record timeline]
  communicate --> remediate[Fix or rollback]
  remediate --> postmortem[Write postmortem]

Required Incident Notes

• Start time and detection time.
• User or operator impact.
• Mitigation steps.
• Commands executed.
• Evidence links.
• Follow-up owners and due dates.