A Runbook for the First Hours That Keeps Its Own Log INCIDENT

In an incident the steps are known; the record is what never gets kept, because everyone is busy doing the incident. This runs the playbook and logs the run: times, decisions, evidence hashes and actions.