/* ============================================================
   Respuesta a Incidentes · estilos propios
   Reutiliza ciberseguridad.css (hero, planes) y ciso-virtual.css (secciones)
   ============================================================ */

/* Primera hora de un incidente */
.inc-first-hour {
  list-style: none;
  counter-reset: paso;
  max-width: 860px;
  margin: 0 auto;
  padding: 0;
  display: flex;
  flex-direction: column;
  gap: 0.75rem;
}
.inc-first-hour li {
  counter-increment: paso;
  display: flex;
  align-items: flex-start;
  gap: 1rem;
  padding: 1rem 1.25rem;
  background: var(--idata-surface);
  border: 1px solid var(--idata-border);
  border-left: 3px solid var(--cyber-green);
  border-radius: 0.8rem;
}
.inc-first-hour li::before {
  content: counter(paso);
  flex-shrink: 0;
  width: 32px;
  height: 32px;
  display: inline-flex;
  align-items: center;
  justify-content: center;
  border-radius: 50%;
  font-weight: 800;
  color: #04120c;
  background: var(--cyber-green);
}
.inc-first-hour i { color: var(--cyber-green); font-size: 1.15rem; margin-top: 0.2rem; flex-shrink: 0; }
.inc-first-hour strong { display: block; color: var(--idata-white); font-size: 0.95rem; margin-bottom: 0.15rem; }
.inc-first-hour span { color: var(--idata-muted); font-size: 0.87rem; line-height: 1.5; }

/* Tarjetas apiladas en "Qué no hacemos" / "Qué reportes pueden corresponder":
   .ciso-signal usa height:100% (pensado para una tarjeta por columna) */
#limites .ciso-signal { height: auto; }