Points to remember
The following are some important points to remember:
- IC: In charge of the incident response, designates responsibilities and optionally takes on roles that were not designated, such as CL.
- OL: Deals with resolving or handling the incident – technical and tactical; executes the action plan by working with a Primary and Secondary Responder.
- CL: The public face of incident response; responsible for communicating to all the stakeholders.
- PL: Tracks system changes, identifies long-term changes by filing bugs, and arranges hand-offs.
- Command post: Refers to a meeting room or Slack channel where communication happens.
- Live incident state document: Maintained by the CL about the incident and updates, and is later used for the postmortem.
- An incident or outage should be called if specific expertise is needed, if the outage is visible, or if the issue is not resolved after an hour or so of effort.
- Factors to overcome in order...