develop an incident response policy

[chadwhitacre]

Ported from gratipay/gratipay.com#684.

I heard a great description of this briefly at Bar Camp Buffalo a few weeks ago, didn't meet the person who gave it though. "Rule 0 is 'Don't panic'. The incident response policy is what you end up doing anyway, but if you write it down ahead of time you can skip the panic and perform a lot better."

It's things like:

• turn $EVERYTHING off
• review $EVERYTHING
• clean $EVERYTHING up