Incident response runbook template
Give an on-call team a clear coordination path for a service incident. Replace the generic actions with your service-specific diagnostics, escalation contacts and recovery checks.
The procedure, step by step
Detect and log
On-call responder
Record the alert, affected service, observed symptoms and incident start time.
- 2
Assess impact and severity
Incident lead
Check customer impact and scope. Assign an incident lead and severity using the team’s criteria.
Major incident?
Incident lead
Decide whether the incident needs the major-incident escalation and communication path.
- 4
Escalate and communicate
Incident lead
Engage the required specialists and publish an initial status update through approved channels.
- 5
Contain and mitigate
Response team
Choose an approved mitigation, record the action and monitor whether it reduces the impact.
- 6
Verify recovery
On-call responder
Confirm service health and customer-facing behavior. Keep monitoring and communicate the recovery status.
Review and follow up
Incident lead
Document the timeline and contributing factors. Assign owners for corrective actions and update the runbook.
Expected outcome
Service restored, stakeholders updated and follow-up actions assigned.
More starting points
These are example procedures, not legal, compliance or security advice. Adapt them to your team’s policies before use.