Incident response lifecycle

Incident response lifecycle A lifecycle diagram generated by Archify. 01 / Response 02 / Pause + Escalation 03 / Outcome Detected · breach or silence · Response 01 Detected breach or silence Notified · SMS, then voice · Response 02 Notified SMS, then voice Acknowledged · named person · Response 03 Acknowledged named person In action · on site · Response 04 In action on site Closed · recovery verified · Response 05 Closed recovery verified Paused · mute with expiry · Pause · logged Paused mute with expiry logged Escalated · next on-call · Escalation · no progress Escalated next on-call no progress Reviewed · incident record · Outcome Reviewed incident record backup responds Legend start active state waiting decision terminal success failure / exit neutral

Main rail

  • • Every alert needs a named acknowledgement
  • • Closed only after recovery is verified

Guards

  • • Mutes expire and are logged
  • • No progress escalates to the backup responder