Things to capture - alerts & report channels - investigation and escalation path - incident types (coverage) and severity