What are your first 3 steps in an incident?

[Hive80-lab]

A question for ops folks here: what are the first three things you actually do when an incident starts?

I've been reading public postmortems (Cloudflare, GitLab, Fastly) and the pattern is blunt: the teams that come out okay aren't the ones with the biggest runbooks — they're the ones with the clearest first 30 minutes. Under stress you don't rise to your wiki; you fall to your checklist.

The 3-step opener that keeps showing up in every good postmortem:

1. Freeze. Stop deploys and rollbacks. Half the cascading damage in famous outages came from actions taken during a provider incident.
2. Classify. Upstream or us? Check the vendor's status page and one independent signal (is a second region/client broken?). Ten minutes of classification saves hours of wrong-direction work.
3. Say one line out loud. Internally + a customer-visible status line: "We know. Investigating. Next update in 30." Then hit that deadline.

After that: handoffs written down as you go (not reconstructed at the end), and an out-of-band comms channel — vendor dashboards are frequently behind the thing that's down.

For transparency: I run a small ops-tools shop, and I've packaged this as a free one-page checklist (no signup): https://hive80lab.gumroad.com/l/first-30-minutes — steal it and adapt it. If you want the fuller kit (incident log templates, escalation ladder, postmortem skeleton), that's here: https://hive80lab.gumroad.com/l/ops-starter-kit

Curious what your first 3 steps are — especially the unwritten ones people only learn from a bad night.