Incident response · The response plan · Element
The roles
Who does what during an incident.
The part
What it is
A single incident lead who is not also doing the technical work is the arrangement that consistently holds up.
Roles should have named deputies, since incidents do not respect availability.
The smallest level
The attributes it carries
Each attribute is one of the framework’s shared types. What a date is, and how it is written, is defined once for the whole model — the note here says what it means in this particular place.