Define the decision
Record what was observed, when it began, who reported it and which services or records may be affected. Distinguish confirmed facts from suspicions. An incident might involve an unavailable tool, an unintended file disclosure, a broken integration or corrupted records. Give the record a stable reference and an accountable incident owner.
Build a usable record
Contain the confirmed issue through authorised controls while preserving relevant evidence. Document each action, person, time and reason. Record the affected release or record versions and any unknown extent. Protect sensitive logs and customer information in the incident file; a public service note should contain only the approved information needed by its audience.
Check the evidence boundary
Define recovery checks before declaring resolution. Verify the affected journey, permission boundary or data correction and record the result. Notification and reporting duties depend on the incident and applicable process; involve the responsible operator promptly rather than assuming a generic template settles them. Keep follow-up corrective actions separate from the immediate recovery.
Worked example — illustrative
In a fictional incident, a material comparison page loads an old data file after a release. The operator pauses the affected advice, verifies which records were displayed and restores the correct version. The report records the scope actually checked, the customer-facing correction and the cache-control improvement without claiming unrelated systems were audited.
Put the method into practice
Use the incident template to capture chronology, evidence, containment, recovery and review actions. Leaf’s form creates a local draft and does not notify an operator or external authority. Actual monitoring, escalation and service changes require the delivered production system and authorised operating process.
- Separate facts from suspicions.
- Preserve versions and evidence.
- Record containment authority.
- Verify the affected recovery journey.