When everything breaks at once.
WHAT HAPPENS
Volume spikes immediately, with many reports of one problem.
WHAT TO DO FIRST
Confirm it is an incident, not one customer's problem.
HOW
Check monitoring, and whether reports share a pattern.
WHAT TO DO NEXT
Publish an acknowledgement, before answering individually.
WHY BEFORE
One message reaches everyone; individual replies reach a handful.
WHERE TO PUBLISH
A status page, hosted separately from your infrastructure.
WHAT TO SAY
What is affected That you are working on it When the next update comes
WHAT NOT TO SAY
Speculation about the cause An estimate you cannot meet Nothing
WHAT TO DO WITH INCOMING TICKETS
Link them to the incident, and reply with the same information.
WHY LINK THEM
It lets you notify everyone when it is resolved.
WHAT CADENCE TO UPDATE ON
The interval you promised, even with no news.
WHY EVEN WITH NO NEWS
Silence is interpreted as nothing being done.
WHAT TO DO WHEN RESOLVED
Confirm it, to everyone affected.
WHAT TO DO AFTERWARDS
Publish an account of what happened.
WHY
Handled openly, an incident increases trust.
WHAT SUPPORT SHOULD FEED BACK
How customers were affected, in practice.
