Maintain a safe incident notebook

1. Keep a dated timeline of what you actually observed, not imagined events.

2. Preserve only minimal evidence needed for troubleshooting in an access-controlled location.

3. Track uncertainty separately from confirmed findings.

4. Record owner communication, mitigation, test outcome and next review date.

5. Exercise: turn a local failed deployment into a precise incident report.

Scope: Education and testing on owned or explicitly authorized systems only.