[WIP] Update guide on incidents

source/runbook.html.md.erb

@@ -7,6 +7,29 @@ weight: 5
 
 This document contains some basic instructions for fixing common issues encountered operating the service.
 
+## Define incident priority
+
+Define technical incident priority levels for your service’s applications. For example potential incidents include:
+
+- system access problems
+- wider technical failures with possible reputational impact to MHCLG
+- denial of service (DoS)
+- data breach or leak
+- defacement
+- unauthorised use of systems
+- suspicious activity, such as traffic from an unknown source
+
+Assign a priority level to incidents based on their complexity, urgency and resolution time. Incident severity also determines response times and support level.
+
+### Incident priority table
+
+|Classification|Type|Example|Response time|Update frequency|
+|---|---|---|---|---|
+|#P1|Critical|Complete outage, or ongoing unauthorised access|20 minutes (office and out of hours)|1 hour|
+|#P2|Major|Substantial degradation of service|60 minutes (office and out of hours)|2 hours|
+|#P3|Significant|Users experiencing intermittent or degraded service due to platform issue|2 hours (office hours only)|Once after 2 business days|
+|#P4|Minor|Component failure that does not immediately impact a service, or an unsuccessful DoS attempt|1 business day (office hours only)|Once after 5 business days|
+
 ## Outage Procedure
 
 When an outage occurs the following process should be followed.