Incident communication and handoffs

Silence creates rumor. Oversharing creates panic. A steady rhythm of short updates, using the same status words each time, keeps the company calm and the facts accurate.

The big idea

Each audience needs a different level of detail and a different pace. Engineers in the channel need every change. Leaders need impact and a next-update time. Customers need what is broken and what to do about it.

Cadence by audience

The status template

Use the same shape every time, so readers can scan it:

Status: INVESTIGATING | MITIGATING | MONITORING | RESOLVED
Impact: checkout errors elevated for about 15% of requests
Since: 14:02 UTC
Actions taken: rolled back payments deploy at 14:18 UTC
Next update: 14:45 UTC

Move through the states in order. When the fix is in, say MONITORING for a soak period. Move to RESOLVED only after the error rate stays down. A premature all-clear costs trust, especially when the errors come back.

Internal truth vs external truth

Internal channels can name suspicions. External pages stick to what users can see.

Naming a vendor, guessing a root cause or promising an exact ETA you do not control creates legal and trust problems when you are wrong. If you publish a bad update, correct it quickly. Silence after a wrong all-clear is worse than a revision.

Handoffs and closing

A clean handoff states five things: the current severity, the impact numbers, the mitigations already applied, the active hypotheses, and the next planned action with the next update time. The outgoing commander stays until the incoming one repeats that summary back correctly.

When the incident is resolved:

1. Keep the channel open for a cool-down, often a few hours.
2. Capture open questions for the postmortem while memory is fresh.
3. Page only if monitoring shows a regression.
4. Schedule the blameless postmortem within a few days.

Common mistakes

• Declaring RESOLVED too early. Use MONITORING for the soak period.
• Naming a vendor before the facts are solid.
• A silent status page for an hour. Post an update even if it only says "still investigating."
• Promising an ETA you do not control.

Check yourself

1. Why say MONITORING instead of RESOLVED right after a fix? Error rates can climb again. A premature all-clear costs trust.
2. Which audience gets the suspected root cause? The internal channel. External pages stick to user-visible facts.

Key takeaways

• Update on a cadence, and use the same status words each time.
• Keep internal and external messages different, on purpose.
• Hand off with severity, impact, mitigations, hypotheses and the next update.
• Close only after a soak period.

Further learning

After the incident, write the review in the postmortem guide.