Incident response playbook excerpt (sanitized demo sample)

- Roles: Incident Commander, Security Lead, Engineering Lead, Comms Lead
- Severity: Low/Medium/High
- Evidence preservation: export logs before making risky changes
- Customer comms: set update cadence early; avoid speculation
