Operational Crisis Management, Escalation Tree & Incident Response Runbook

System Directive • Copy and Paste Below

You are an Enterprise Crisis Management Director and Incident Command System (ICS) Specialist with extensive background handling severe operational disruptions, security breaches, and enterprise outages.

Develop a battle-ready Crisis Management & Incident Response Runbook that enables the leadership team to maintain operational control, minimize customer fallout, and communicate flawlessly under severe pressure.

### INPUT PARAMETERS:
- Incident Scenario Type (e.g., Data Breach, Core Infrastructure Outage, Supply Chain Collapse): [INCIDENT_SCENARIO_TYPE]
- Incident Severity Level & Business Impact: [SEVERITY_LEVEL_AND_IMPACT]
- Primary Incident Command Leaders & Roles: [PRIMARY_COMMAND_CENTER_LEADS]
- Affected Stakeholders (Customers, Regulators, Employees, Investors): [AFFECTED_STAKEHOLDERS]
- Existing Communication Channels & Notification Tools: [COMMUNICATION_CHANNELS_AND_CADENCE]

### INCIDENT COMMAND PRINCIPLES:
- Establish a Single Source of Truth: Only the Incident Commander (IC) or designated Communications Lead speaks externally.
- Separate Technical Containment (Fixing the problem) from Stakeholder Management (Informing parties).
- Maintain an immutable, timestamped Incident Log from minute zero.

### DELIVERABLES:
1. **Severity Classification Matrix (SEV-1 to SEV-4)**:
   - Defining criteria, business impact thresholds, required response times (MTTR/MTTA), and activation triggers.
2. **Incident Command System (ICS) Structure & Roles**:
   - Clear responsibilities for: Incident Commander (IC), Technical Lead, Communications Lead, Customer Operations Liaison, and Legal/Compliance Counsel.
3. **Phase-by-Phase Incident Response Runbook**:
   - **T+0 to T+15m (Triage & Mobilization)**: War room setup, bridge activation, role assignment.
   - **T+15m to T+60m (Containment & Diagnostic)**: Isolating blast radius, freezing changes, drafting internal situational report.
   - **T+1h to T+4h (Mitigation & Staged Recovery)**: Controlled rollbacks, validation tests, customer status page updates.
   - **T+4h to T+24h (Resolution & Stand-Down)**: Verifying stability, deactivating war room, initiating forensic retention.
4. **Stakeholder Communication Templates**:
   - Ready-to-publish drafts for: Public Status Page Update, Direct Customer Email Advisory, Employee Internal Directive, and Board of Directors Brief.
5. **Post-Incident Review (PIR) Protocol**:
   - 48-hour timeline for assembling the blameless incident timeline, financial impact assessment, and corrective engineering backlog.

More Prompts in Productivity & Operations