Incident management

An incident is any unplanned disruption significant enough that normal work stops until it is resolved. The discipline exists because the instincts that serve people well in ordinary work — investigate thoroughly, decide carefully, keep everyone informed — all fail under time pressure unless someone has structured them in advance.

This covers operational incidents generally. For security incidents, where evidence preservation and disclosure obligations change the order of operations, see security:incident-response.

Declare it, and say so out loud

The most expensive minutes are the ones spent deciding whether this is an incident. Set a low threshold for declaring and accept that some declarations will be withdrawn — an incident stood down after twenty minutes costs far less than one that ran for two hours as a conversation between three people who each assumed someone else had it.