PREPARATION
├── Classification framework defined (category + severity)
├── Escalation procedures documented and tested
├── Communication templates ready
├── War room procedures established
└── Roles and responsibilities assigned

DETECTION & ANALYSIS
├── Alert triage → incident declaration
├── Severity assignment via matrix
├── Timeline reconstruction begins
├── Stakeholder notification per severity
└── Documentation starts immediately

CONTAINMENT, ERADICATION & RECOVERY
├── War room activated (S1/S2)
├── Containment strategy selected (short-term / long-term)
├── Eradication of threat actor presence
├── Recovery and service restoration
└── Continuous documentation and status updates

POST-INCIDENT ACTIVITY
├── Root cause analysis (5 Whys, Ishikawa)
├── Lessons learned / blameless retrospective
├── Metrics capture (MTTD, MTTR, MTTC)
├── Detection gap remediation
├── Trend analysis update
└── Process improvements implemented

TIER 1 — SOC Analyst (0-15 min)
├── Initial triage and classification
├── Severity assignment
├── Stakeholder notification (S1/S2 immediate)
└── Escalate if: confirmed malicious, scope unclear, S1/S2

TIER 2 — Incident Lead (15-60 min)
├── Assume incident command
├── Activate war room (S1/S2)
├── Coordinate containment
└── Escalate if: business impact, legal/regulatory trigger

TIER 3 — CISO / Executive (as needed)
├── Business decisions (pay/don't pay, disclose/don't)
├── Regulatory notification authorization
├── External communication approval
└── Resource allocation

Operational Metrics:
├── MTTD: Mean Time to Detect — alert to declaration
├── MTTR: Mean Time to Respond — declaration to containment
├── MTTC: Mean Time to Close — declaration to resolution
├── MTTRE: Mean Time to Remediate — RCA finding to fix deployed
├── Recurrence Rate: incidents reopened / total incidents
└── Escalation Accuracy: correct severity at declaration

Process Metrics:
├── Documentation Completeness: required fields filled %
├── Lessons Learned Completion: retros held within SLA %
├── Action Item Closure Rate: retro actions completed on time %
└── Communication SLA: stakeholder updates sent within SLA %

Trend Metrics:
├── Incidents by category (monthly)
├── Incidents by severity (monthly)
├── Top 5 root causes (quarterly)
├── Repeat incident rate (quarterly)
└── Detection coverage improvement (quarterly)

INITIAL NOTIFICATION (S1/S2):
Subject: [INCIDENT-{ID}] {Severity} — {Short Description}
Body:
  Status: ACTIVE
  Severity: {S1|S2|S3|S4}
  Impact: {description of business impact}
  Current Actions: {what is being done now}
  Next Update: {time of next scheduled update}
  Incident Commander: {name}
  War Room: {link/location}

STATUS UPDATE:
Subject: [INCIDENT-{ID}] UPDATE #{n} — {Status}
Body:
  Status: {ACTIVE|CONTAINED|ERADICATED|RESOLVED}
  Changes Since Last Update: {what changed}
  Current Actions: {what is being done now}
  Next Update: {time}

RESOLUTION NOTIFICATION:
Subject: [INCIDENT-{ID}] RESOLVED — {Short Description}
Body:
  Status: RESOLVED
  Duration: {total time from declaration to resolution}
  Root Cause: {brief summary}
  Impact Summary: {systems/users affected}
  Lessons Learned Review: {scheduled date}