The Incident Response Runbook 2.3C.4-2

An incident response runbook is a pre-committed decision framework — the organizational expression of encoded objective law (1.2.2) applied to crisis. The decisions about who leads, who communicates, what thresholds trigger escalation, and how the institution transitions from response to recovery are made before the incident, not during it. Under pressure, organizations revert to their structure. If the structure is absent, they revert to whoever is loudest or highest-ranking — which is luck, not resilience.

Incident Classification

Not all incidents require the same response. Classify by severity.

Severity 1 — Critical. Institution-threatening events: data breach affecting customers, fraud or financial misrepresentation, discrimination or rights violation, safety incident affecting persons, or regulatory violation with enforcement risk. Response: immediate activation of incident team, executive notification, external communications plan, and regulatory notification if required.

Severity 2 — Significant. Events that damage institutional capacity or trust without being existential: system outage affecting operations, vendor failure disrupting service, policy violation by a manager, or financial error requiring correction. Response: incident lead activated, investigation within defined timeframe, leadership briefing, and root-cause analysis.

Severity 3 — Routine. Events that require attention but not mobilization: minor process failures, individual performance issues, low-impact system errors, or customer complaints within normal parameters. Response: documented by responsible party, reviewed in next regular meeting, tracked for patterns.

Incident Response Roles

Define these roles before any incident occurs. Assign by position, not by person — the role transfers if the person is unavailable.

Incident lead. Coordinates the response. Makes tactical decisions about containment, investigation sequence, and resource allocation. Does not make institutional-level decisions (those require executive authority per the charter).

Communications lead. Controls messaging — internal first, external when required. Ensures that information is accurate, timely, and consistent. Does not speculate. Does not assign blame.

Investigation lead. Gathers facts. Documents the timeline. Identifies what happened, what was supposed to happen, and where the gap occurred. Does not propose solutions during the investigation phase — investigation and solution are separated to prevent premature closure.

Executive sponsor. Has charter authority to make institutional-level decisions: shutting down a system, suspending a person, engaging external counsel, or authorizing expenditure for remediation. The executive sponsor authorizes but does not direct — tactical decisions remain with the incident lead.

The Response Sequence

Contain

Stop the harm from spreading. If the incident is a data breach, revoke access. If it is a financial error, freeze the affected accounts. If it is a rights violation, separate the parties. Containment is not investigation — it is structural first aid.

Investigate

The investigation lead documents: what happened (timeline), what was supposed to happen (policy, protocol, code), where the gap occurred (structural failure, human error, external cause), and who was affected. The investigation is factual. It does not assign blame. It does not editorialize. It does not propose solutions.

Communicate

The communications lead manages messaging in sequence: internal first (people affected, then leadership, then the organization), external second (regulators if required, then customers or partners if affected, then public if necessary). Communications say what is known, what is being done, and when the next update will come. They do not speculate, minimize, or deflect.

Remediate

Based on the investigation findings, the incident team proposes structural changes — not behavioral exhortations. Not "we will be more careful" but "we will add a segregation-of-duties check at this process step, require a second approval at this threshold, and implement monitoring at this access point." Remediation proposals go through change control (2.3C.3) like any other protocol change.

Postmortem

The blameless postmortem follows the three-part structure established in the narrative accountability practice (2.3C.1-3): what happened, what the institution learned, and what changed. The postmortem is published internally — making the learning visible and the structural change auditable.

Track: did the remediation prevent recurrence? If the same incident type recurs within twelve months, the fix was superficial and requires structural escalation.

Graceful Degradation

The institution should be designed to continue functioning at reduced capacity during an incident — not to fail entirely. Graceful degradation means: critical functions continue with manual fallbacks, non-critical functions are suspended with defined resumption criteria, communications continue on schedule, and the institution does not make irreversible decisions under crisis pressure unless the charter explicitly authorizes emergency action (2.3C.1-1).

Integration Points

• Institutional charter (2.3C.1-1): The charter defines which roles have authority during incidents, what escalation thresholds apply, and what emergency powers exist.
• When judgment hardens (2.3C.1-2): Incident response must not allow claims to harden into binding rules without the four-state due process — even under crisis conditions.
• Encoded objective law rollout (2.3C.3): Remediation proposals follow change control and rollback procedures. Incident response does not create permanent rules without proper process.
• Organization evidence pack (2.3C.4-3): Incident postmortems, remediation records, and recurrence tracking are part of the evidence pack.