---
name: Incident Response
description: Mitigate, then diagnose — in that order.
---
# Incident Response

During an incident, the first job is to stop the bleeding; the second is to understand why. Reversing this order extends the outage while you debug.

## Phases
1. **Acknowledge & scope.** Is it real? Who's affected? How bad? Define the incident so responders know what they're fighting.
2. **Mitigate.** Roll back, scale up, shed load, fail over. Restore service by any reversible means. Don't fix forward under pressure.
3. **Diagnose.** Once stable, find root cause. Now you have time and a working system to investigate on.
4. **Resolve.** Apply the real fix.
5. **Postmortem.** Blameless written analysis: what happened, why, what to change so it can't recur (or recurs gracefully).

## Roles
- **Incident commander** coordinates, doesn't type. One mind holding the whole picture.
- **Comms** updates stakeholders on a cadence. Silence breeds speculation.