- Detection — alert fires, customer reports, monitoring spots anomaly
- Triage — assess severity, declare incident, page the on-call
- Response — investigate, communicate, mitigate (restore service)
- Resolution — root cause identified, fix applied, service confirmed healthy
- Post-incident review (PIR / post-mortem) — what happened, why, what to change
- Follow-up — action items tracked to completion