Begin containment within the clock the severity sets

Incident Response policy, §4.2, §4.3

Containment begins within 30 minutes of confirmation for a Critical incident, within 2 hours for High, and within 8 business hours for Moderate. The Technical Lead executes containment under the Incident Commander, and any step that interrupts customer service or settlement is the Incident Commander’s decision. The root cause is removed before an affected system returns to production, and both the Technical Lead and the Incident Commander confirm recovery.

Event-driven

Each confirmed incident: 30 minutes for Critical, 2 hours for High, 8 business hours for Moderate

Decide and execute the containment steps, record the time each began, eradicate the root cause, and sign off recovery before systems return to production.

• Containment log

  Each action, who took it, and the time, against the confirmation time

• Recovery sign-off

  Technical Lead and Incident Commander confirmation with date

Engineering

Leela can keep the containment clock from the confirmation time and flag the incident when the deadline is near or missed.

Tell Leela about your company to see whether this applies.