How should incident response in cloud be designed for production in Cloud Security?

Predefine roles and runbooks, centralize logs, preserve snapshots and evidence, isolate resources, rotate credentials, and rehearse scenarios.