Incident Response Runbook: Prepare, Execute, Improve

Phases

1. Prepare: roles, contacts, access, runbooks, test scenarios.
2. Execute: triage, contain, eradicate, recover.
3. Improve: post-mortem, action items, validate fixes.

Make it routine: quarterly tabletops, and monthly checks of paging, logging, and backups.