Compliance · Incident response · Component
The incident definition
What counts as an incident, at what severity, written before one happens — so recognising it is not itself a judgement under pressure.
The deliverable
What it is
Incidents are frequently recognised late because nobody was sure whether the thing qualified, and the person who noticed had no low-cost way to raise it.
The definition should err wide. Standing down a non-incident is cheap; recognising one late is not.
One level in
What it is made of
Each element is a constituent part of the component. Follow one to see the attributes it carries.
The definition
What qualifies as an incident.
3 attributes: Definition · Category · Near miss included
LearnThe severity levels
How incidents are graded, and what each level triggers.
3 attributes: Level · Criteria · Triggers
LearnThe raising route
How someone reports a possible incident, and how easy that is.
3 attributes: Route · Reaches · Response time
Learn
Standing down a non-incident is cheap. Define incidents wide and make raising one easy.
The other components in incident response
The response plan
Containment, roles, notification deadlines and who decides — settled in advance, because the clock runs during the incident.
LearnThe post-incident review
Root cause and what changed, kept separate from the incident record itself so that learning is not mixed with the account of events.
Learn