Incident leadership
On this page 9 topics
Overview
Topics
- Coordination
- communications
- blameless postmortems
Learn first
3.5 h of practice (estimate)
Learning outcomes
- Act as incident commander: assign roles, set priorities, and keep responders focused.
- Communicate to stakeholders at a steady cadence with impact, actions, and next update.
- Decide on risky mitigations with incomplete information.
- Facilitate a blameless postmortem that finds systemic contributing factors and gets actions done.
Lessons
Lab and exercises
Lab
SRC-019-LAB1 · Command a game day
Outcomes: 1–4 · Time: ~3.5 h Lead a multi-team simulated incident on the order subsystem with role-players: assign roles, run the response, send cadenced updates, decide on a risky mitigation. Then facilitate its blameless postmortem. Acceptance: assessed on coordination, communication, and action quality.
Exercises (assessment: incident-command simulation, a graduation gate component)
| ID | Outcome | Task |
|---|---|---|
| SRC-019-EX01 | 1 | Case: five responders join at once and all start debugging. Write your first three messages as IC. |
| SRC-019-EX02 | 2 | Write three consecutive stakeholder updates for a 90-minute checkout outage, including one with no new information. |
| SRC-019-EX03 | 3 | Choose between rolling back, failing over, and shedding load with unclear evidence. Complete a decision table and state your check. |
| SRC-019-EX04 | 4 | Rewrite blaming postmortem lines ("Alex deployed without testing") into blameless contributing factors. |
| SRC-019-EX05 | 4 | Draft five actions from an incident, make each specific, owned, and dated, and rank them. |
| SRC-019-EX06 | 1 | Case: you have been IC for six hours. Plan a handover and explain what to include. |
Show solutions
- EX01 Declare incident and name IC, assign ops lead, comms lead, scribe; state the goal (restore checkout) and ask for hypotheses with owners and a check-in time.
- EX02 Each update has status, impact, actions, next update time. The no-news update says so, confirms actions continue, and gives the next time.
- EX03 Prefer the reversible, bounded option such as rollback or shedding; state the assumption and the signal that shows it worked; ask a second opinion and time-box.
- EX04 For example: "The deployment process allowed a change without load testing and had no canary analysis; the checklist did not cover pool sizing."
- EX05 Examples: add canary analysis (owner, date), alert on pool saturation, add a runbook step, practice rollback; rank by prevention and detection value.
- EX06 Handover: current state, hypotheses and tests, actions in flight, stakeholders and cadence, pending decisions; say it aloud and confirm acceptance.
- Outcome 2 is also covered by the lab and Q04-Q05.
Workplace evidence: an incident you led as commander and its postmortem.
Quiz
Outcomes: O1 incident commander · O2 stakeholder communication · O3 decisions under uncertainty · O4 postmortems.
A self-check for you: nothing is graded, saved or sent anywhere. Choose an answer, then check it. You can try again as often as you like.
Practical part
Incident-command simulation (SRC-019 assessment, graduation gate component) and the SRC-019-LAB1 postmortem. Pass: at least 8/10 on the quiz, and a simulation assessed as sound on coordination, communication, and action quality.
Common mistakes
Commander debugging instead of coordinating; silent periods for stakeholders.
Assessment
Incident-command simulation (graduation gate component).
Workplace evidence
An incident you led as commander and its postmortem.
Career relevance
Incident and crisis leadership (STF-018).