Major Incident Management for Small Teams
At 08:52 the file server stops answering. By 08:55 the desk has nine tickets that are all the same ticket. The phone is ringing. Two directors are standing behind the one technician who is actually typing. The other technician is explaining to the fourth caller that yes, they know. Nobody has said the word incident. Nobody has decided who is fixing and who is talking. The fixer is answering questions over their shoulder, which is a reliable way to fix nothing. A major incident on a small team is not a technical problem with a communication problem attached. It is a coordination problem that happens to involve a server.
This series is for the desk of two to six people who will never have an incident manager and need one anyway. It covers what makes an incident major and who may say so. It covers declaring it and the first fifteen minutes, with three roles shared between two people. It covers coordinating with a bridge and a timeline log while keeping the crowd out of the fixer's way. Then comes communicating during the incident, from the incident lead's seat. It covers closing it and running a blameless review. And it covers writing the one-page playbook before the big one, so the first fifteen minutes are a checklist and not a debate. The outage will happen. The scramble is optional.
Articles in This Series
- What Makes an Incident Major, and Who Gets to Say So
The definition in plain words, the criteria (people affected, a process stopped, no workaround), who may declare, the declaration test, and a criteria card. - Declaring an Incident and the First Fifteen Minutes
The declaration message, the three roles even with two people, the incident ticket, linking the related tickets to it, and a first-fifteen-minutes checklist. - Coordinating a Major Incident With Two People
The lead/fixer split, the bridge, the timeline log, keeping the crowd out of the fixer's way, and the incident log to copy. - Communicating During the Incident: The Lead's Routine
The incident lead's routine: the first notice, the update interval, what to say when there is nothing new, the channels, the all-clear, and the three messages. - Closing the Incident and the Review That Follows
The all-clear, closing the linked tickets, the blameless review, the timeline, action items with owners, and a one-page review. - Preparing Before the Big One: The One-Page Playbook
The one-page incident playbook, the contact list, decision rights, the practice run, and the playbook itself.
Explore More Topics
This series is part of the QuerySolv helpdesk topic library. It covers the foundations, processes, communication, knowledge, tooling, metrics, classic ticket domains, people and strategy behind a support desk that works. The library pairs well with the software we build: QuerySolv. It is a self-hosted help desk that runs as one Windows service on your own network. It is licensed once per installation, not per agent per month.