The first hour.
WHAT TO DO FIRST
Establish what is broken, and for whom.
WHAT NOT TO DO
Start changing things before understanding the scope.
WHAT TO ESTABLISH
Is it everyone or some people? Is it everything or one function? When did it start? What changed beforehand?
THAT LAST QUESTION
Most incidents follow a change. It is the fastest route to a cause.
WHAT TO DO ABOUT AN INCIDENT FOLLOWING A DEPLOYMENT
Revert first. Investigate afterwards, with service restored.
WHAT TO ASSIGN
Someone leading, someone communicating, someone investigating.
WHY SEPARATE
The person fixing cannot also be answering questions.
WHAT TO COMMUNICATE
That you are aware What is affected When you will next update
WHAT TO AVOID
Speculating about causes publicly Promising a resolution time you cannot meet Silence
WHAT TO RECORD AS YOU GO
Times, observations, and actions taken.
WHY
Memory is unreliable, and the record is what you review afterwards.
