JohnFen's answer addresses the incident response side. The other half is that you want to fix problems upstream to prevent these incidents in the first place. A

JohnFen's answer addresses the incident response side. The other half is that you want to fix problems upstream to prevent these incidents in the first place. A general process that you should take and edit: 1. Run blameless post-mortems to figure out what caused the incident and more importantly what actions would have prevented the incident from occurring in the first place 2. Prioritize doing the corrective action. This can be as simple as checklists for specific procedures or could be the addition of automated tests/static analysis/linting or automating a procedure. Focus on low-lift quick wins here if possible. You should be selling these corrective actions as required maintenance such as changing the oil in your car. 3. Rinse and repeat. For SAAS products some things that really make a difference are automated test suites, monitoring, and _documented_ procedures