Incident Response
IR-02Begin containment within the clock the severity sets
How Leela would run itEvent-driven · each confirmed incident: 30 minutes for Critical, 2 hours for High, 8 business hours for Moderate
From the policy libraryThe requirement
Containment begins within 30 minutes of confirmation for a Critical incident, within 2 hours for High, and within 8 business hours for Moderate. The Technical Lead executes containment under the Incident Commander, and any step that interrupts customer service or settlement is the Incident Commander’s decision. The root cause is removed before an affected system returns to production, and both the Technical Lead and the Incident Commander confirm recovery.
- Applies
- Tell Leela about your company to see whether this applies.
- Status
- Setup needed
Tell Leela how you handle it today, or hand it over: see what’s next.
The work
Decide and execute the containment steps, record the time each began, eradicate the root cause, and sign off recovery before systems return to production.
What Leela keepsThe evidence this obligation leaves, as the work happens
Listed from the policy libraryContents
- 01Containment logEach action, who took it, and the time, against the confirmation time
- 02Recovery sign-offTechnical Lead and Incident Commander confirmation with date
Evidence
Containment log
Incident Response §4.2, §4.3
2
of 2 records
The work and the records come from this obligation in the policy library.