During any incident our priorities are as follows:
- Restore business functionality
- Learn from any mistakes made
Avoid assigning blame during any incident, this is counter-productive and does not serve to move the the business forward in any way.
When facing an incident, it's important to breath and keep your bearings. Remember the OODA loop.
- Observe
- Take inventory of the situation and take all reports & concerns seriously.
- Orient
- Determine the relationship between the systems to put yourself in a position to grasp the situation.
- Decide
- As a team, come to a decision over what the best course of action.
- Act
- Execute on that decision.
Rinse and repeat until the situation is resolved.
-
Keep an up to date time line of events. This information will be valuable after the incidents resolution to help make decisions to improve reactions or prevent future incidents.
-
Note down steps you've already taken and what their outcomes were.
-
If time allows, go ahead and make a copy of the template. Keep it up to date with the incident you are currently facing. Obviously not all of the information necessary to complete a report will be available at this point, but it will help record valuable information and prevent it from being lost.