Incident Response Plan Generator

---

name: incident-response-plan

description: >

Generate a tailored incident response plan for AI agent deployments and SaaS operations.

Covers detection, triage, containment, recovery, and post-mortem. Use when deploying

agents to production, preparing for SOC2 audits, or building operational resilience.

Built by AfrexAI.

metadata:

version: 1.0.0

author: AfrexAI

tags: [incident-response, security, operations, devops, enterprise]

---

# Incident Response Plan Generator

Generate a production-ready incident response plan tailored to your AI agent deployment.

When to Use

Input

Service: [Name of AI agent/service]
Environment: [cloud provider, region, architecture]
Data Sensitivity: [low/medium/high/critical]
Team Size: [number of responders]
SLA: [uptime target, e.g., 99.9%]
Integrations: [list of connected systems]

Plan Structure

1. Severity Classification

| Level | Description | Response Time | Examples |

|-------|------------|---------------|----------|

| SEV1 — Critical | Service down, data breach, financial impact | 15 min | Agent sending wrong data to clients, API keys exposed |

| SEV2 — High | Degraded service, partial outage | 1 hour | Agent responses slow, one integration failing |

| SEV3 — Medium | Non-critical issue, workaround exists | 4 hours | Minor accuracy drop, cosmetic errors |

| SEV4 — Low | Enhancement, no immediate impact | Next business day | Feature request, optimization |

2. Detection & Alerting

3. Triage Checklist

□ Confirm the alert is real (not false positive)
□ Classify severity (SEV1-4)
□ Identify affected scope (which agents, which clients)
□ Check recent changes (deploys, config changes, upstream)
□ Assign incident commander
□ Open incident channel/thread
□ Notify affected stakeholders per SLA

4. Containment Actions by Type

**Agent Misbehavior:**

**Infrastructure Failure:**

**Security Incident:**

**Data Quality Issue:**

5. Communication Templates

**Client notification (SEV1/2):**

Subject: [Service Name] — Incident Update

We've identified an issue affecting [description].
- Impact: [what's affected]
- Status: [investigating/identified/monitoring/resolved]
- ETA: [estimated resolution time]
- Workaround: [if available]

We'll provide updates every [30 min / 1 hour].

**Internal escalation:**

🚨 SEV[X] — [Service]: [Brief description]
Impact: [scope]
Started: [time]
Commander: [name]
Channel: [link]
Action needed: [specific ask]

6. Recovery & Validation

□ Root cause identified and documented
□ Fix deployed and verified
□ All affected data corrected/reconciled
□ Client communication sent (resolution)
□ Monitoring confirms stable for 30+ min
□ Incident timeline documented

7. Post-Mortem Template

# Incident Post-Mortem: [Title]
**Date:** YYYY-MM-DD
**Severity:** SEV[X]
**Duration:** [start] — [end] ([total time])
**Commander:** [name]

## Summary
[2-3 sentence description]

## Timeline
- HH:MM — [event]
- HH:MM — [event]

## Root Cause
[Technical root cause]

## Impact
- Users affected: [number]
- Duration: [time]
- Data impact: [description]
- Financial impact: [if applicable]

## What Went Well
- [item]

## What Went Wrong
- [item]

## Action Items
| Action | Owner | Due Date | Status |
|--------|-------|----------|--------|
| [item] | [name] | [date] | Open |

## Lessons Learned
- [lesson]

Best Practices

---

*Need incident response built into your AI operations from day one? AfrexAI deploys production-grade AI agents with monitoring, alerting, and response plans included. Book a call: [calendly.com/cbeckford-afrexai/30min](https://calendly.com/cbeckford-afrexai/discovery-call)*