Incident response

When something goes down in production, the first minutes decide a lot: whoever improvises wastes time figuring out who to alert and what to check first, while the problem grows and users get angry. Having a written plan turns panic into a sequence of steps anyone on the team can follow, even if they are on call at three in the morning.

This template orders the response from the moment you confirm something is wrong to the post incident review, moving through containing, investigating and communicating. It does not aim to solve it for you, it aims to make sure nobody in the middle of a crisis has to recall the protocol from memory or skip notifying the affected users out of haste.

The response steps

These are the steps the template brings, in the order worth taking during the incident:

• Confirm the scope of the incident and who it affects
• Declare the severity level to know how much to mobilize
• Gather the needed team and name who coordinates
• Communicate the status to those affected as soon as possible
• Contain the problem right away to stop the damage
• Investigate the root cause once it is stabilized
• Apply the definitive fix, not just the patch
• Verify everything is back to normal
• Close the incident and notify that it is resolved
• Write the post incident review without hunting for blame

How it works in Foco

When you import it, Foco creates the "Incident" workspace with these steps in the List view, grouped by date so that in the middle of a crisis you see at a glance what is up now and what is still pending. You tick each step as you complete it and never lose the thread even when a thousand messages fire at once.

You can mark the containment as urgent, assign the investigation to whoever knows the system and set yourself a reminder so you do not forget the post incident review once the scare passes. Voice notes let you quickly record what you are seeing without stopping to type.