How should incident response in cloud be designed for production in Cloud Security?

Predefine roles and runbooks, centralize logs, preserve snapshots and evidence, isolate resources, rotate credentials, and rehearse scenarios. The implementation should be justified by measurable requirements, kept as simple as the problem allows, and validated with realistic tests, telemetry, failure handling, and documented tradeoffs.