dawka
Sign inCreate a document
← All templates

Template preview · Software

Incident response plan

Prepare clear roles and actions for a service incident.

A practical response plan for a fictional online service.

Sample purpose

Prepare clear roles and actions for a service incident.

Audience: SRE, Incident commander
Structure
4 sections
Criteria
16
Sources
12
Watches
4
Default approach
Review first
See the sample

Set the purpose first. Then change every section, criterion, and agent setting before anything runs.

Fictional sample

Structure and criteria

Sample content shows the shape of a useful document. Copying it is optional.

  1. 01

    Activation criteria

    Define when the plan starts and who leads.

    Manual

    Criteria

    • The trigger names a metric and a duration (20% export failures for 10 minutes)
    • Triggers are justified by past incidents they would and would not have caught
    • Names the commander by title and a declaration deadline (5 minutes after breach)
    • Names the channel and who to page first

    Sources

    Sample content

    • ☑ Activate when export failures exceed 20% for 10 minutes
    • ☑ Incident commander: on-call lead Ana
    • ☑ Open fictional #inc-lantern-export channel
  2. 02

    Roles and responsibilities

    Give each incident activity one accountable person.

    Review first

    Criteria

    • Command, operations and communications each have exactly one owner
    • Roles are titles, so shift changes do not break the plan
    • Each responsibility is a checkable action, not 'handles operations'
    • Only one role may commit to customer timelines

    Sources

    Watches

    • Follows Activation criteria

    Sample content

    RoleResponsibility
    Incident commanderSets priorities and approves status.
    Operations leadInvestigates export queue and mitigates.
    Communications leadPosts customer update.
  3. 03

    Response timeline

    Capture expected immediate actions in order.

    Review first

    Criteria

    • First internal and customer updates fit the contract SLA window
    • States the customer update cadence (every 15 minutes)
    • Recovery verification names a concrete check (a test export completes in 2 minutes)
    • Times come from past incident timelines

    Sources

    Watches

    • Follows Roles and responsibilities

    Sample content

    1. T+0 · DeclareConfirm scope and assign roles.
    2. T+15 · UpdatePublish known impact and next review time.
    3. T+45 · VerifyConfirm exports complete for test accounts.
  4. 04

    Readiness checks

    Keep preparation gaps visible before an incident occurs.

    Review first

    Criteria

    • Each drill has an owner and a date
    • Each completed drill records what it found, not just 'done'
    • Drills use failure modes from recent postmortems
    • Follow-up actions stay listed until closed with evidence

    Sources

    Watches

    • Follows Roles and responsibilities
    • Follows Response timeline

    Sample content

    Last tabletop drill
    2026-01-20
    Open readiness actions
    2