Prepare severity levels, incident roles, containment, evidence preservation, customer communications, recovery criteria, and post-incident reviews.

How to apply it

Coordinate an incident lead, technical responders, and communications owner as needed. Share confirmed impact and next update time. Support intake includes tenant, time, request ID, expected behavior, and actual behavior—never passwords.

Worked example

A status update names affected service, impact, mitigation, and next update time without promising unverified recovery.

Common mistakes to avoid

Blaming individuals, making uncoordinated production changes, or requesting secrets in tickets.

Practice task

Implement this concept in the capstone. Add one positive test, one negative or failure-path test, and a short note explaining the trade-off you chose.