PIVTR-D
A field manual for incident responders.
Taken straight from Joshua Wright's excellent updated IR book, molded into a tldr guide for the common incident responder. The lifecycle, the decisions that go with it, and the paperwork nobody enjoys writing at two in the morning but everyone is glad of at the after-action review.
Find the phase you are in and go to its playbook. Each one says what starts the phase, what finishes it, what record it leaves behind, and what to check along the way. Decide these before the incident holds the decisions that should already have been made, so look there before improvising one at speed. The lifecycle orients anyone who walks onto the bridge halfway through.
The source book is free to read and download at dynamicincidentresponse.com, and SANS has its own page for it at sans.org/engage/dynamic-incident-response.