Capability 15 / 18
Incident Response
Calm, structured command when things break, and a postmortem that fixes the root cause.
How a team handles the worst ten minutes of an incident says more about its engineering culture than any architecture diagram. Structured incident command — clear roles, clear communication, no heroics required — turns a chaotic outage into a manageable one.
The postmortem afterward is where the real value is: finding the actual root cause instead of the first plausible explanation, and turning it into a change that prevents the repeat, not just a line in a document nobody rereads.
What this looks like in practice
- •Incident command with clear roles, so response doesn't depend on who happens to be online
- •Root-cause analysis that goes past the first plausible explanation
- •Postmortems that produce tracked follow-up work, not just a writeup
- •Live production debugging under pressure, backed by tracing and structured logs