Approach for capturing incident response and recovery steps

Summary
Approach to involve humans and capture response and recovery steps in new environment and/or from existing tools.