Incident Command Governor

When To Use

• You need a reusable incident command packet from messy operational inputs.
• You need explicit severity assessment, stakeholder updates, and action ownership.
• You need a governed workflow that can be reviewed, maintained, and audited over time.

Do Not Use

• The task is only to explain an incident concept.
• The task is only to draft a one-off update.
• The request is still brainstorming and not yet packaging a repeatable incident workflow.

Workflow

1. Gather the minimum incident inputs:

• incident summary
• timeline evidence
• affected systems and customers
• severity indicators
• owners and responders
• stakeholder audiences

1. Read references/severity-matrix.md to assign or confirm severity.
2. Read references/comms-policy.md to shape internal and external updates.
3. Read references/review-policy.md before finalizing, because this skill is maintained under a monthly review cadence.
4. Use scripts/build_incident_packet.py with input/incident_input_example.json when deterministic packet assembly is needed.
5. Produce one governed incident packet with:

• incident summary
• severity block
• evidence-backed timeline
• affected scope
• owner and action table
• internal and external comms blocks
• explicit open risks and review notes

1. Stop and report blockers if severity evidence or ownership data is missing.

Output Contract

The final answer must include:

• a concise incident summary
• explicit severity and rationale
• a timeline section
• impact scope
• owners and next actions
• stakeholder communication blocks
• governance note for follow-up review

Validation Checklist

• Severity is justified with evidence, not guessed.
• Owner and next actions are explicit.
• Communications are separated by audience.
• Missing evidence is surfaced as a blocker.
• The packet can be reviewed again without reconstructing context from chat history.

Reference Map

• Read references/severity-matrix.md for severity rules.
• Read references/comms-policy.md for communication guidance.
• Read references/review-policy.md for review cadence and governed lifecycle expectations.
• Inspect evals/trigger_cases.json for routing boundaries.
• Inspect outputs/incident_packet_example.md for an example final artifact.
• Inspect reports/governance_score.json for the current maturity snapshot.