Incident and crisis leadership
On this page 9 topics
Overview
Topics
- Coordinating major incidents
- strategic corrective actions
Learn first
3.5 h of practice (estimate)
Learning outcomes
- Lead major incidents that span many teams and external parties.
- Communicate with executives, customers, and regulators during a crisis.
- Turn major incidents into strategic corrective actions across the organization.
- Improve the incident process itself after each crisis.
Lessons
- 01When an incident becomes a crisis
- 02Leading many teams in an incident
- 03Crisis communication
- 04From postmortem to strategic action
- 05Improving the incident process
- 06Looking after responders
- 07Demo: a simulated payment-provider outage on the busiest day of the year
- 08Demo: presenting a crisis review to the executive team
Lab and exercises
Lab
STF-018-LAB1 · Crisis game day
Outcomes: 1–4 · Time: ~3.5 h
- Prepare the crisis roles, channels, update cadence, and runbook.
- Lead a multi-team, multi-hour simulated crisis with role-played executives and a partner (the assessor injects new facts).
- Communicate with executives, customers (draft messages), and a regulator contact if relevant.
- Run a blameless review and write the strategic corrective-action plan with owners and funding.
- Write three changes to the incident process itself.
Acceptance: actions address systemic causes and have owners and funding.
Exercises (case-based; six exercises)
| ID | Outcome | Task |
|---|---|---|
| STF-018-EX01 | 1 | Decide whether three scenarios are incidents or crises, and write the roles you activate for each. |
| STF-018-EX02 | 1 | During a payment outage, you find yourself debugging. Write what you do to return to leadership. |
| STF-018-EX03 | 2 | Draft the first executive update and customer message for a two-hour provider outage. |
| STF-018-EX04 | 2 | A regulator requires notification within a deadline. Plan who is involved and when. |
| STF-018-EX05 | 3 | Convert three local fixes from a postmortem into systemic actions with owners and funding. |
| STF-018-EX06 | 4 | Review the crisis process after a game day and write three improvements with measures. |
Show solutions
- EX01 Crisis: many teams, customer or revenue impact, external parties. Roles: commander, communications lead, liaison, scribe, workstream leads.
- EX02 Hand the technical thread to the workstream lead, restore the shared timeline, set the next sync, and keep to coordination.
- EX03 Executive: impact, what we know, actions, next update in 30 minutes. Customer: plain language, what is affected, workaround, next update; no speculation.
- EX04 Involve legal and compliance at declaration; check obligations and deadlines for the jurisdiction (verify); designate the owner; record the timeline for the notice.
- EX05 Example: "add timeout to service X" becomes "shared client library with timeouts and circuit breakers adopted by all teams"; owner, funding, due date, check via game day.
- EX06 Improvements such as faster declaration criteria, a standing executive liaison, updated contact lists; measures: time to declare, time to first update, action completion.
Outcome 4 is also covered by the lab process changes; responder wellbeing is covered in the quiz.
Workplace evidence: a major incident you led and the organizational change that followed.
Quiz
Outcomes: O1 leading multi-team incidents · O2 crisis communication · O3 strategic corrective actions · O4 improving the incident process.
A self-check for you: nothing is graded, saved or sent anywhere. Choose an answer, then check it. You can try again as often as you like.
Practical part
Six case exercises STF-018-EX01 to EX06 plus the lab, assessed in a crisis simulation. Pass: at least five of six exercises correct, quiz at least 8/10, and a corrective-action plan whose actions address systemic causes and have owners and funding.
Common mistakes
Taking over the technical work; silence toward executives; corrective actions that are only local fixes.
Assessment
Crisis simulation.
Workplace evidence
A major incident you led and the organizational change that followed.
Career relevance
Operational architecture (ARC-038).