Incident Response

4. Fix

• Minimal blast radius — smallest change that restores service
• Rollback if possible, hotfix if not
• Test fix before deploying

5. Post-Mortem (within 48 hours)

# Post-Mortem: [Incident Title]
## Date: [YYYY-MM-DD]
## Severity: [P0-P3]
## Duration: [How long]
## Impact: [Who/what was affected]

## Timeline
| Time | Event |
|------|-------|
| HH:MM | [What happened] |

## Root Cause
[Technical root cause]

## Contributing Factors
[What made it worse or harder to detect]

## Action Items
| # | Action | Owner | Deadline |
|---|--------|-------|----------|
| 1 | [Specific action] | [Name] | [Date] |

## Lessons Learned
[What to do differently]

Never blame individuals. Focus on systems and processes.