5 skills.
Use when asked to write a business continuity plan (BCP) — an organization-wide plan for keeping critical operations running through a major disruption (facility loss, supplier failure, pandemic, natural disaster) — as distinct from disaster-recovery-testing (see below), which is the IT-systems-only slice of this.
Use when asked to write or review an incident response plan — the pre-defined process for handling a security or operational incident while it's happening, including severity levels, roles, and escalation — as distinct from a [[postmortem]] (the after-the-fact analysis once the incident is over) and a [[business-continuity-plan]] (broader, org-wide continuity planning rather than tactical in-the-moment response).
Use when asked to write or facilitate a postmortem — a blameless, after-the-fact analysis of an incident, its timeline, root cause, and follow-up actions — as distinct from an [[incident-response-plan]] (what happens during the incident, not after) and a routine [[agile-reflection]] (triggered by an incident, not run on a scheduled cadence).
Use when asked to write a runbook — a step-by-step operational procedure for a specific, recurring task or system situation, such as restarting a service, rotating a credential, or failing over a database — as distinct from an [[incident-response-plan]], which governs roles and communication during an incident rather than the precise technical steps for one specific action.
Use when asked to threat model a system or feature — proactively analyzing a design for security weaknesses before it's built — as distinct from penetration-testing (see below), which attacks a system that already exists.