2-incident-response.md

Incident Response

	Language Used	Behavior Displayed
Novice	Generalized statements regarding events/activities in progress, i.e. "Something is wrong with the network!" "I have no idea what to do." "Have you tried turning it off and turning it on again?" No standard language.	Team is event-focused; some (or all) of the team are "alarmed" by the occurrence of incidents and the actions taken in response The commencement of an incident is “fuzzy” and occurs primarily external to the team (manual NOC notification via “call-out” or email) Inconsistent response once incident has commenced
Beginner	"I think there’s a problem with the database, network," etc. "I think [specific person] is familiar with how that works; we need to find them" Standardized language among the teams	The team is area-focused, i.e. incidents involve specific system components; some (or all) of the team "fears" the occurrence of incidents Incident response based on "tribal knowledge" and usually requires specific people to effectively respond Incident remediation is inconsistent and based on the specific actors involved in the response
Competent	"The deployment caused the database to hang." "We've got a knowledge base article on how to handle this." Some team members are familiar with standardized Incident Management System terminology and may use it during incident responses.	The team is action-focused; they are "aware" that incident occurrence is a normal side effect of system operations The commencement of incidents is well-defined and well-understood by the team; most incident response are triggered via automated alerting/monitoring The team has identified incident "responders" and those incident responders know what is expected of them
Proficient	"Have the database, network and search on-calls perform a systems status and report back to the incident commander." Team is familiar with standardardized Incident Management System terminology	The team is technology-focused; they "accept" that incident occurrence is a normal side effect of system operations Incident response becomes an aspect of organizational and team “culture”; incident response expectations and “how tos” are part of on-boarding/recurrent training Teams collaborate cross-functionally to determine overall plan for large-scale incident response coordination and resolution
Advanced	"What parts of the service did not 'self-heal' and need manual intervention?" "System A on-call rep and System-B on-call rep both reported issues which may seem related? Are we sure those two groups are talking to each other? If not, let's put them in touch immediately." Team uses/values standardardized Incident Management System terminology	The team is systems-focused; they "embrace" incidents as learning experiences and improvement opportunities Incident conclusion criteria and processes are documented and understood by incident responders and includes crew dissolution steps and inputs into the ongoing incident remediation process The organization considers outside-normal-business hours incident response or repeated business-hours incident response to be inhumane to system operators