When something breaks.
WHAT TO DO FIRST
Establish scope: what is affected, and who.
WHAT TO DO SECOND
Communicate, early, to those affected.
WHY EARLY
Silence during an outage generates more work than the outage.
WHAT TO ASSIGN
Someone coordinating, someone diagnosing, someone communicating.
WHY SEPARATE THOSE
Whoever is diagnosing cannot also be answering questions.
WHAT TO ASK
What changed?
WHY
Most incidents follow a change, and that question resolves many in minutes.
WHAT TO DO ABOUT A RECENT CHANGE
Revert first, investigate afterwards.
WHY
Restoring service matters more than understanding immediately.
WHAT TO RECORD DURING
Times, observations, and actions taken.
WHY
Memory is unreliable, and the record is what the review depends on.
WHAT TO AVOID
Several people changing things simultaneously Changes nobody records Declaring resolution before verifying
WHAT TO DO AFTERWARDS
A review, without blame, establishing the cause and what allowed it.
WHAT TO PRODUCE
Specific actions, with owners.
WHAT TO CHECK LATER
Whether they were done.
