Incident Response Flowchart: Alert to Postmortem

Mermaid code

flowchart TD
    A[Alert fires] --> B[On-call acknowledges]
    B --> C{Severity?}
    C -->|SEV1 outage| D[Page incident commander]
    C -->|SEV2 degraded| E[Open incident channel]
    C -->|SEV3 minor| F[Create ticket for next sprint]
    D --> E
    E --> G[Mitigate: roll back or fail over]
    G --> H[Post status page update]
    H --> I{Service restored?}
    I -->|no| G
    I -->|yes| J[Resolve incident]
    J --> K{SEV1 or SEV2?}
    K -->|yes| L[Blameless postmortem within 5 days]
    K -->|no| M[Close]
    L --> M

Paste this into any tool that renders Mermaid, or into the editor to change the theme and export PNG or SVG. Syntax reference: Flowchart guide.

What this diagram shows

The Severity? diamond is the first fork. SEV1 pages an incident commander before joining the incident channel; SEV2 goes straight to the channel; SEV3 becomes a ticket and leaves the hot path. Mitigate and Post status page update loop until Service restored? is yes. A second diamond sends SEV1 and SEV2 incidents to a Blameless postmortem within 5 days before Close.

How to adapt it

• Replace the three severity labels with your own scale and definitions, and keep them identical to the ones in your alerting tool.
• Add a Notify legal or security node off the SEV1 branch if incidents can involve data exposure.
• Change within 5 days to your actual postmortem deadline, or remove the time limit if you do not enforce one.
• Insert a Declare incident publicly? diamond before the status page node if updates require approval.

FAQ