Locked
Incident Response Playbook: Your First 5 Minutes
By the end, you'll know the signs of an active incident, exactly what to do in the first 5 minutes (and what not to do), how to report it, and what {{team}} does after you report. You'll be prepared to be the first line of defense.
All employees, especially IT-adjacent, operations, support, anyone who might notice something first · ~18 min · 5 modules
This course is part of the paid catalog. Purchase it individually, or unlock it with a membership that includes Tier 1 & 2 content.
What's inside
- 01~3 minTrust the feeling that something's wrongYou don't need certainty to report an incident. You need a pattern, a feeling, or a fact that doesn't fit. That's enough. Report it.
- 02~4 minThe first 5 minutes — your playbookDon't investigate. Don't try to fix it. Don't panic. Follow these 5 steps and you've done your job perfectly.
- 03~4 minCommon scenarios — what you might seeThese are the patterns that show up in real incidents. None are certain, but all are worth reporting.
- 04~3 minWhat NOT to do — common mistakesGood intentions can make incidents worse. Here are the mistakes that look helpful but actually hurt.
- 05~4 minAfter you report — what happens nextYou've done your job in 5 minutes. Here's what {{team}} does, what you should expect, and what they'll ask of you.