The honest take: Your phone goes off at 3:14 AM. The monitor says login is failing in three regions. You are about to be the Incident Commander, the Communications Lead, and the Operations Lead at the same time, because there is no one else awake. Here is the playbook for what happens next. Most of it is deciding which role to be in which minute, not which command to run. The commands are the easy part. You are wearing all three core ICS roles right now The Google SRE Book's Managing Incidents chapter (Chapter 14) defines four roles for any production incident under the Incident Command System (ICS): Incident Command (IC), Operational Work, Communications, and Planning. For a solo founder, Planning collapses into IC because there is no multi-day coordination to schedule. The three you actively cycle through are IC, Ops, and Comms. The IC owns the incident, makes decisions, and holds the timeline. Comms talks to customers and stakeholders. Ops touches the production system.…