the incident is identified through automated alerts, business metric anomalies, or user reports. **(2) Triage** — the incident is classified by severity (SEV-1 through SEV-4) and type (system, data, model, integration), determining the response urgency and the team that responds. **(3) Mitigation**