INCIDENT / RECOVERY TABLETOP
Incident owner/time window/user impact and severity rationale:
Trusted observations (counts,version,config) versus unknowns:
Immediate containment within authorized scope:
Evidence preserved without credentials/private payloads:
Code rollback eligibility/schema compatibility:
Data restore need/recovery point/newer changes/separate target:
Recovery acceptance checks and actual results:
Cloud resource cleanup/retention exceptions/follow-up owner:
Communication draft (do not send from this exercise):
Timeline and supported cause/contributing factors:
Prevention action | owner | measurable acceptance:
Local/tabletop/unexecuted production boundaries:
Do not declare an incident resolved from unrelated successful drills.
