Incident Response Runbook State Diagram Template

An incident response runbook state diagram visualizes every discrete phase an incident passes through, from the moment an alert fires to the final post-mortem review. Each state—Detected, Triaged, Mitigating, Resolved, and Post-Mortem—is represented as a node, while transitions capture the decisions and actions that move an incident forward or backward through the workflow. By mapping these states explicitly, on-call engineers and security responders gain a shared mental model of where an incident stands at any given moment, reducing confusion during high-pressure situations.

## When to Use This Template

This template is most valuable when your team is formalizing or auditing an existing incident response process. Use it during runbook creation sprints, onboarding sessions for new SREs, or after a major outage reveals gaps in your escalation logic. It is equally useful for compliance reviews—frameworks like SOC 2 and ISO 27001 require documented incident handling procedures, and a state diagram provides an auditable, easy-to-read artifact. Teams adopting SLO-based alerting will also find it helpful for aligning detection thresholds with triage criteria, ensuring the diagram reflects real operational behavior rather than aspirational process.

## Common Mistakes to Avoid

One of the most frequent errors is collapsing triage and mitigation into a single state. These are distinct phases with different owners, time budgets, and success criteria—merging them obscures accountability and makes it harder to measure mean time to mitigate (MTTM). Another pitfall is omitting re-entry paths: incidents often regress from Mitigating back to Triaged when a fix fails or scope expands, and a diagram that only shows a linear flow will mislead responders. Finally, teams frequently forget to model the Cancelled or False Positive state, which is a legitimate and common outcome after detection. Leaving it out forces responders to improvise, creating undocumented shortcuts that erode process integrity over time. Keep transition labels concise but specific—'escalate to Tier 2' is more actionable than a generic arrow—and always include an explicit terminal state so stakeholders know when an incident is truly closed.