I have experience applying ICS-style process to incidents and have delivered training to ~hundreds of engineers at $job. I am partial to this PD doc: https://response.pagerduty.com/training/courses/incident_res...

this is detailed in the Google SRE book: https://sre.google/workbook/incident-response/