Assess the impact and agree who makes the next decision.
Assess the impactRecord affected services and what people can still do.
Contain and coordinateFollow the agreed incident plan and assign responsibilities.
Agree recoveryConfirm the recovery sequence and who can authorise it.
Keep the response organised
Response coordination
Decision
What needs to be clear
Business impact
Affected services, workarounds and urgent dependencies.
Responsibilities
Technical lead, business decision-maker and communication contact.
Recovery authority
Who approves the selected recovery approach and its risks.
Updates
Who needs information and when the next update is due.
Containment and recovery actions depend on the incident and the agreed service. Keep a record of decisions and preserve relevant evidence through the authorised response process.