Establish incident command and activation authority
Separate detection, declaration, incident command and resource authorization so response begins through explicit accountable decisions.
Name command
- Assign an incident commander and business owner.
- Record timezone and declaration date.
Retain activation basis
- Connect declaration to observed evidence and continuity criteria.
- Monitoring is not declaration.
Bound authority
- State communication and resource authority.
- A plan does not itself authorize production changes.
Retain the incident record
The Incident Response Studio keeps service impact, actions, checkpoints, communications, lessons and decisions connected. It does not notify anyone, change systems, spend money or prove recovery without evidence.