DevOps Operating practice

Incident Command

Coordinates an active major incident with clear command, shared situation, communication, and documented handoff.

Incident Command coordinates an active major incident through clear command, a shared situation picture, communication, and a documented handoff. The method connects operational control with traceable transfer of responsibility.

Core question

Who commands, who works the technical problem, and how do we maintain a shared situation?

Prepare plan Method guide

Start comparison

Give feedbackIs this method useful to you?

Participants: 4-15
Time: As needed

Phases may be revisited; their order supports the work but does not replace domain judgment.

Incident Command workspace showing the question, observations, and next decision.

Command
Declare and lead
Set severity and objectives; name Incident Commander and assign roles.
Situation
Establish situation
Collect symptoms, user impact, systems, and confirmed facts in one log.
Coordination
Coordinate work and communication
Assign technical workstreams; set status cadence and audience.
Handover
Stabilize and hand off
Verify recovery, state residual risks, document command handoff, and schedule review.

Review the result and open assumptions at the next suitable checkpoint. Record changes, ownership, and new evidence.

A good fit when

Use when: An active incident requiring coordination, multiple responders, or external communication.

Ideal for

Major Incidents
On-call Operations
Cross-team Response

Not good for

Small local bugs
Uncoordinated ad-hoc debugging

Outputs

Working picture
Severity, objectives, Incident Commander, and assigned roles.
Testable evidence
Technical workstreams, status cadence, and audience.
Next step
Verified recovery, stated residual risks, documented command handoff, and scheduled review.

Situation, workstreams, and handoff

Fictional worked example

Coordinate an active major incident with clear command, shared situation, communication, and documented handoff.

Situation

Record severity, Incident Commander, and start time.

Payment confirmations delayed; SEV-1 declared at 14:05.

Roles

Separate confirmed facts, hypotheses, impact, and open questions.

IC: Sam; Operations: Jo; Communications: Lee; Scribe: Pat.

Cadence

Assign workstreams, update cadence, and audience.

15-minute situation update; one incident log; technical changes have an owner.

Handoff

Document stability criteria, residual risk, and accepted handoff.

After queue stabilizes: IC hands off to service owner; schedule separate learning review.

Fictional: payment confirmation outage. Incident Commander coordinates and sets 15-minute updates; Operations Lead checks backlog and rollback; Communications Lead publishes customer status; Scribe logs timestamps. Once stable, roles are formally handed off and a separate postmortem is scheduled.

Incident management at Google · Google Cloud

First step

Start with a bounded question, clarify access and participants, and collect available evidence. Coordinate an active major incident with clear command, shared situation, communication, and documented handoff.

Open the method guide

Good to do first

Operations

Runbook

Supplies the prepared procedure that the incident commander acts on.

Where to go next?

DevOps

Blameless Postmortem

Examines, after stabilization, how the incident could occur.

DevOps

Game Day

Rehearses the coordination used in the response as a controlled scenario.

Deep dive

Purpose

During an acute incident with several people involved, the method creates a clear leadership and communication structure. It reduces chaos when fast coordination and clean situational awareness are both needed at once.

How it works

Central coordination keeps decisions, information, and responsibilities together while other roles absorb the operational pressure. Communication and intervention stay orderly even as the situation changes quickly. The benefit lies in fast alignment, not extra bureaucracy.

In detail

Incident Command bundles coordination, communication, and decision authority in acute situations. Roles should relieve pressure and keep status updates understandable while technical work runs in parallel. Extra titles help little; the approach works when confusion, duplicated effort, and stakeholder noise noticeably decrease.

Facilitation

Roles, communication channel, and escalation line should be clearly explained at the start of the incident, before operational hectic sets in. The turning point is reached when status communication no longer falls apart alongside repair work. Close with a clean handover or deliberate stand-down so no one stays stuck in a half-open response.

The method guide walks execution through 4 phases, timing, 4 pitfalls, and clear stop criteria.

Open method guide

Your perspective

Does this method help with your work?

Your feedback helps shape the next improvements to methodatlas.

Sources and topics

Topics

Incident Operations Reliability

Sources

Incident management at Google · Google Cloudcloud.google.comMethod reference reviewed to support the scope and workflow of Incident Command. Examples and editorial guidance are original and explicitly fictional.

In playbooks

Improve the Deployment and Platform FlowMove from a simulated outage through practiced incident response to a documented, improved learning loop.

Artifact templates

Incident Command: WorksheetPrepare Incident Command with a clear question, roles, and sources.

markdown

incident-command-working-template.md

Prepare Incident Command with a clear question, roles, and sources.

Incident Command: Worksheet

Question

To be confirmed

Desired outcome

To be confirmed

Scope

Plan the full method Time: Set according to scope and available evidence

Complete this worksheet on paper or in your own document during the work.

Preparation for this scope

Method setup

Materials: Shared workspace, accessible sources, and a decision log.
Roles: Incident Commander · Operations · Communications · scribe
Advance information: Clarify the question, timeframe, data access, roles, and known uncertainties in advance.
Overall time needed: For the duration of the incident; roles, update cadence, and handoffs adapt to the situation.
Setup: Create a shared version. Label facts, assumptions, and decisions separately.