Incident Management Training

Thomas Depierre

• Unplanned
• Disruptive
• Affect Customers or Company

What is an incident

• Approach and process
• Assess and Manage
• Limits damage and risks
• Reduce recovery time and costs

What is Incident Management

• Some automated ways
• Manually
• If you are not sure, trigger one

• /incident

When to trigger an incident

• Incident are different
  • High tempo
  • High pressure
  • High stakes

Emergency Mode vs Normal Mode

• Usual work organisation do not work
• Too slow, not adapted to high risk/stakes
• Mandatory to shift to Emergency

Emergency Mode vs Normal Mode

• Riskier actions
• Unscheduled actions
• Broken Process
• Disruption of Schedule

Emergency Mode vs Normal Mode

• Incident commander/Facilitator(IF)

• Scribe
• Communications (Comms)
• IC/SME

Roles in an Incident

• Keeps the process going

• Make sure decisions are taken
• Recenter communications
• Full Authority over the response channels

Incident Facilitator

• Marks the important message as such

  • Reactji

• Regulary produce/update a summary
  • What we know, what we are doing
  •  Helps people get up to speed when they join

Scribe

• Find who stakeholders are

• Find what they want to know
• Keep them updated regularly
• Ask question to the responders to answer
• Mobilise and recruit ressources
  • we need someone from "X"

Comms

• /incident  in Slack

• Create a channel
• declare an Incident Commander
• Create an entry in the incident.io tool

Starting an incident

• /incident

• Important!

• Do not care about most "state" of incident in incident.io

• Except for this one.

• Resolved or Closed

Closing an incident