{
  "uid": "cogitave.learn.respond-to-incidents.the-incident-response-model",
  "kind": "moduleUnit",
  "href": "/modules/respond-to-incidents/the-incident-response-model/",
  "title": "The incident-response model",
  "summary": "",
  "type": null,
  "products": [],
  "roles": [],
  "levels": [],
  "subjects": [],
  "headings": [
    "Detection and declaration",
    "Severity: one scale, and the override that always wins",
    "Command: the single-commander model",
    "Containment through recovery: the runbook",
    "Closing the loop: the blameless postmortem"
  ],
  "source": "The canonical, company-wide plan is\n[`incident-response-plan.md`](../../../../ops/incident-response/docs/incident-response-plan.md).\nIt models the lifecycle on **NIST SP 800-61r3** (2025), reframed around the six\n**CSF 2.0** Functions: the continuous readiness Functions - **Govern, Identify,\nProtect** - and the incident-time Functions - **Detect, Respond, Recover** -\nwith **Learn** feeding findings back into readiness. This unit walks that live\nloop: detect, declare, command, contain, recover, learn.\n\n## Detection and declaration\n\nAn incident opens from, in order of how most arrive: an **SLO burn-rate alert**\ncarrying a `runbook_url` (no page without a runbook), the\n[security-triage agent](../../../../agents/scheduled/security-triage.md)\nclassifying a signal (human-gated), a **customer report** escalated by support,\nor any engineer's own observation. Anyone may declare, and nobody is blamed for\ndeclaring something that turns out minor - the plan's rule is\n**declare-high-downgrade-later**: when uncertain, declare at the higher\nseverity and downgrade once the facts firm up.\n\n## Severity: one scale, and the override that always wins\n\nCogitave runs **one** severity scale, S1-S4, detailed in the\n[severity matrix](../../../../ops/incident-response/docs/severity-matrix.md). S1\n**always** declares a full-response incident; S2 declares when its blast radius\nis multi-tenant or growing, has no workaround with a fast-burning error budget,\nor is trending toward S1; S3/S4 are worked in the queue.\n\n> [!IMPORTANT]\n> A **security-relevant** signal routes onto the security-incident path\n> regardless of its apparent severity - even one that looks like an S3. The\n> override pages `oncall-security` and engages the Security lead before\n> anything else. Apparent severity never outranks a security signal.\n\n## Command: the single-commander model\n\nRoles are **functions, not job titles**, detailed in\n[roles-and-raci](../../../../ops/incident-response/docs/roles-and-raci.md): one\n**Incident Commander (IC)** with a clear span of control, an Operations lead,\na Communications lead, a Scribe, and - for security-relevant incidents - a\nSecurity lead. Two separations are absolute: the **IC never debugs hands-on**,\nand the **IC and a responder are never the same person** - you cannot command\nand type at once.\n\n## Containment through recovery: the runbook\n\nEach incident **class** (availability, data, security, agent-safety) has a\n[runbook](../../../../ops/incident-response/runbooks/README.md) that every\nalert's `runbook_url` points to. The [availability-outage\nrunbook](../../../../ops/incident-response/runbooks/availability-outage.md)\nshows the shared shape: **contain** first (acknowledge, roll back a recent\nchange, shed load) before deep diagnosis, then diagnose, mitigate, communicate\non a severity-keyed cadence, and verify recovery before closing.\n\n## Closing the loop: the blameless postmortem\n\nEvery S1/S2 produces a **blameless**\n[postmortem](../../../../ops/incident-response/docs/postmortem.md) within the\nPIR window (default 5 business days). Blameless does not mean\naccountability-free: it treats every \"human error\" as a system gap - a missing\nguardrail, an ambiguous runbook - and assigns owned, dated action items to fix\nthe system, not the person. Those findings feed back into Govern, Identify, and\nProtect, closing the lifecycle diagram above.\n",
  "partOf": "cogitave.learn.respond-to-incidents",
  "durationInMinutes": 9,
  "quiz": null
}