https://leaddev.com/technical-direction/incident-response-before-the-incident