Incident Response Checklist

What this checklist is

An incident response checklist for software teams, covering both outages and security incidents. It walks through preparation, detecting and declaring an incident, roles and coordination, mitigation, security containment and evidence, communication, and closing with a blameless postmortem, with a way to check each item before you need it.

It has 7 chapters and 37 checks, each with how to verify it and how much it matters. For engineering teams that run production systems.

Chapter by chapter

1. Before an incident: preparation (7 checks)

Checks that the people, tools and written procedures exist before anything breaks, because there is no time to create them during an incident.

2. Detecting and declaring an incident (5 checks)

Checks that problems are noticed quickly, that someone officially starts the incident process, and that everyone can find where it is being handled.

3. Coordinating the response (5 checks)

Checks that the response stays organised: clear roles, one group changing the system, a running timeline and clean handoffs.

4. Mitigation and recovery (5 checks)

Checks that the team stops the damage first, changes one thing at a time, and confirms recovery with data rather than hope.

5. When it is a security incident (6 checks)

Checks for incidents where an attacker may be involved: preserve evidence, contain access, rotate secrets and bring in the right people.

6. Communication (4 checks)

Checks that stakeholders and customers hear accurate updates on a predictable schedule, from one voice.

7. Closing the incident and learning from it (5 checks)

Checks that every significant incident ends with a blameless postmortem, follow-up actions that actually get done, and better runbooks.

How it works on Sefism

The checklist is one page: each check has a severity (must, should or nice to have) and a concrete way to verify it, and members can tick checks off as they go. The opening chapters are open to everyone. Adding it to your account uses credits, opens every chapter and keeps your progress.

Every claim is checked against the sources listed on the page (6 cited).