Enterprise Operations & Incident Management Topics
Large-scale operational practices for enterprise systems including major incident response, crisis leadership, enterprise-scale troubleshooting, business continuity planning, and recovery. Covers coordination across teams during high-severity incidents, forensic investigation, decision-making under pressure, post-incident processes, and resilience architecture. Distinct from Security & Compliance in its focus on operational coordination and recovery rather than preventive security.
Incident Communication and Stakeholder Management
Communicating during and after an incident to internal stakeholders, executives, and customers. Covers status-update cadence, war-room communication, translating technical state into business impact, and managing expectations under uncertainty. The communication surface of incident response, distinct from the technical remediation.
Incident Severity Classification and Escalation
Assigning severity to incidents, deciding when and whom to page, and moving an issue up defined escalation paths. Covers severity matrices, escalation criteria, triage decisions, and scope-of-authority calls about when to pull in more responders or leadership. The routing and prioritization discipline that sits at the front of the incident lifecycle.
Site Reliability Engineering Principles
The core SRE practice model: service-level objectives and indicators, error budgets, toil reduction, and reliability as an engineering discipline. Covers the principles and trade-offs behind treating operations as a software problem and balancing reliability against feature velocity. The conceptual foundation questions specific to SRE-style roles.
Log Analysis and Diagnostic Data Gathering
Extracting signal from existing logs and diagnostic output to find a root cause: parsing and querying log data, correlating traces and metrics during an investigation, and gathering the right diagnostic information (including asking clarifying questions) before drawing conclusions. Covers text-processing and query techniques for locating evidence in logs (structured log parsing, ElasticSearch/SQL-style log queries, log aggregation and retention trade-offs) and reconstructing a timeline from the data on hand. This is the analysis-of-existing-data skill used during troubleshooting and investigation across infrastructure and operations roles: distinct from monitoring and observability, which is about instrumenting a system so telemetry exists in the first place (see the observability topics for that), and distinct from SIEM-based security detection and formal digital-forensics practice (chain of custody, artifact/disk/memory analysis), which have their own dedicated coverage elsewhere in the catalog.
Operational Risk Management
Identifying, assessing, and mitigating operational risk before it becomes an incident. Covers risk registers, likelihood/impact assessment, prioritizing mitigations, and operational decision-making that weighs risk against speed. The proactive risk-reduction discipline, distinct from reactive incident handling.
Disaster Recovery and Business Continuity
Planning and executing recovery from large-scale outages and disasters. Covers recovery objectives (RTO/RPO), failover and backup strategy, DR runbook automation, and business-continuity planning that keeps critical operations running through major disruptions. The resilience-and-recovery planning discipline for worst-case events.
Postmortems, Root Cause Analysis, and Blameless Culture
Investigating what caused an incident and turning the lessons into lasting improvement. Covers root-cause techniques (five whys, causal chains, contributing-factor analysis), writing postmortem documents, and tracking follow-up action items to prevent recurrence, as well as facilitating those reviews blamelessly: building psychological safety, treating failures as learning opportunities rather than occasions for blame, and driving continuous-improvement loops across teams. The structured after-the-fact analysis discipline together with the organizational culture that makes it effective.
On-Call Practices and Runbook Design
Running a sustainable on-call function: rotation design, production-readiness handoffs, and authoring runbooks that let responders act quickly. Covers runbook automation, on-call culture, escalation-ready documentation, and readiness reviews before a service takes production traffic. The operational-preparedness discipline that makes incidents survivable.
Monitoring and Observability
Instrumenting systems so their internal state is visible: metrics, logs, and traces, dashboards, and operational health signals. Covers what to measure, how to build observability into services, and how to use telemetry to detect and diagnose problems. Distinct from alerting in that it focuses on visibility and instrumentation rather than notification.