Domain 4: Incident Response

Incident Command, Escalation, and Resolution

Ops Bot | Operations | Max 30 Points

0-6
Ad-hoc
7-12
Foundational
13-18
Standardized
19-24
Advanced
25-30
Optimized

Scoring Criteria by Level

LevelCriteria
1Chaotic response; no IC role; hero culture; no learning
2Basic severity levels; some escalation paths; informal IC
3Defined IC role; runbooks used; postmortems written
4Trained ICs; MTTD/MTTR tracked; blameless culture
5Incident learning system; automated mitigation; chaos drills

Assessment Questions

#QuestionMax
1How well-defined is your IC role?6
2How do you track MTTD/MTTR?6
3How do you conduct postmortems?6
4How effective are escalation paths?6
5How do you train incident responders?6

Focus Areas

  • IC Role: Clear ownership during incidents
  • Escalation: Defined paths with contact info
  • Metrics: MTTD, MTTR, incident frequency
  • Learning: Blameless postmortems with actions

Anti-Patterns (Red Flags)

  • Hero culture (same person always responds)
  • Blame-focused incident reviews
  • No severity classification
  • Postmortem actions never completed
  • Escalation unclear or broken

Evidence Checklist

  • IC rotation schedule exists
  • Severity levels defined with examples
  • Escalation matrix documented
  • Postmortem template in use
  • MTTD/MTTR dashboards available

Related Domains

DomainRelationship
On-CallOn-call handles initial response
AlertingAlerts trigger incident flow
CultureBlameless culture enables learning

Incidents Are Learning Events

Every outage makes us stronger.