Prompt Incident Response

# Prompt — Incident response runbook

> [🇷🇺 Русский](../ru/prompt-incident-response.md) · 🇬🇧 **English**

[← Index](./README.md) · [Standards](./standards.md) · [Template](./template.md)

tags: #prompt #incident-response #sre #ops #service #single-shot
**Status:** `🧪 Experimental`
**Owner:** Pandamy619
**Last edit:** 2026-05-20
**Version:** v1
**Source idea:** [PagerDuty Incident Response](https://response.pagerduty.com/), [Atlassian Incident Handbook](https://www.atlassian.com/incident-management/handbook)
**Delta from original:** strictly separated roles (commander / comms / ops), formalized severity levels with quantitative criteria, added communication timers and a mandatory link to the postmortem prompt.

---

## When to use

- When the team needs a step-by-step incident response playbook for when alerts fire
- When you want to unify roles, communications, and escalations across services
- When incidents happen but actions don't — each time the team improvises from scratch

## What to substitute

- `{{service_name}}` — string, e.g. `payments-api`
- `{{severity_levels}}` — string, e.g. `S1: revenue impact > $10k/h or > 50% users; S2: partial impact; S3: cosmetic`
- `{{on_call_setup}}` — string, e.g. `primary on-call 24/7, secondary business hours; PagerDuty weekly rotation`
- `{{paging_tool}}` — enum: `pagerduty | opsgenie | grafana_oncall | victorops | manual_slack`
- `{{communication_channels}}` — string, e.g. `Slack #incidents-payments; status page status.example.com; email for S1+`
- `{{stakeholder_groups}}` — list, e.g. `engineering leadership; product; legal (if data breach); customer support`
- `{{compliance_constraints}}` — string, e.g. `PCI: notify within 24h; GDPR data breach: 72h`

## Definition of done

Universal minimum — see [Definition of done](./standards.md#2-definition-of-done).

Specific criteria:

- Severity levels are formalized quantitatively (`> N users`, `> $X/h`), not "big/small"
- Each role (incident commander / comms / ops) has an explicit list of actions and an owner
- Communication timers are specified (ack within 5 min, first external message within 30 min, etc.)
- The "when a postmortem is mandatory" section is stated unambiguously, no "at team's discretion"
- Message templates (Slack / status page / email) are filled with real text, not placeholders

## Prompt