Incident Response & Postmortems Cheat Sheet

Structured process for detecting, responding to, and learning from production incidents, including postmortem documentation.

2 PagesIntermediateJan 25, 2026

Incident Response Roles

Common roles used during a major incident.

Incident Commander (IC)- Owns coordination and decision-making, does not necessarily fix the issue
Communications Lead- Manages status page updates and stakeholder communication
Operations Lead / Subject Matter Expert- Drives technical investigation and mitigation
Scribe- Records timeline, actions, and decisions in real time

Typical Severity Levels

Common SEV classification scheme used to prioritize response.

SEV1 / P1- Full outage or critical data loss, all hands, immediate response
SEV2 / P2- Major functionality degraded, significant user impact
SEV3 / P3- Minor impact, workaround available, handled during business hours
SEV4 / P4- Cosmetic or low-impact issue, no urgency

Postmortem Template

Minimal blameless postmortem document structure.

markdown

# Postmortem: Checkout API Outage (2026-07-08)## SummaryOne-paragraph description of impact and duration.## Impact- Duration: 42 minutes- Users affected: ~8,000- Revenue impact: estimated $X## Timeline (UTC)- 10:02 Alert fired: high 5xx rate- 10:05 IC assigned- 10:18 Root cause identified: bad config deploy- 10:44 Rollback completed, service recovered## Root CauseWhat actually broke and why.## Action Items- [ ] Add config validation to CI (owner, due date)- [ ] Add canary deploy stage (owner, due date)## Lessons LearnedWhat went well / what didn't.

Incident Response Flow

High-level sequence from detection to resolution.

Detect- Alert fires or is reported, on-call acknowledges
Triage- Assess severity and assign IC if warranted
Mitigate- Stop the bleeding first (rollback, feature flag off, scale up) before root-causing
Resolve- Confirm metrics/SLIs back to normal, close incident
Review- Write and share the postmortem, track action items to completion

Pro Tip

Mitigate first, diagnose second — rolling back a bad deploy takes minutes and restores service, while root-causing under pressure can extend an outage unnecessarily.

Was this cheat sheet helpful?

Site Reliability Engineering (SRE) Basics Cheat Sheet

Chaos Engineering Cheat Sheet

Explore Topics

#IncidentResponsePostmortems#IncidentResponsePostmortemsCheatSheet#DevOps#Intermediate#IncidentResponseRoles#TypicalSeverityLevels#PostmortemTemplate#IncidentResponseFlow#CheatSheet#SkillVeris

Sri Hayavadhana Info-Tech

Professional Web Designing Services