Incident response
- Confirm and scope the incident.
- Contain the affected path or credential.
- Preserve relevant evidence and logs.
- Recover service through the safest verified path.
- Communicate material customer impact when applicable.
- Review root cause and corrective actions.