Incident Commander: Role, Duties and Handover

The incident commander is the person who leads the response to an incident. The role comes from the Incident Command System used by emergency services and has been adapted by software and operations teams. Its core idea is a separation of duties: the person who coordinates should not be the person who is buried in the fix.

Without a commander, a serious incident tends to turn into several uncoordinated investigations, duplicated effort, contradictory messages to stakeholders and a timeline nobody can reconstruct.

What the commander does

• Declares the scope and severity, and revises them as facts emerge.
• Assigns the other roles and makes sure each is filled.
• Decides between options when responders disagree, and records the decision.
• Keeps the response focused on restoring service rather than on finding blame or on the interesting cause.
• Asks for status at regular intervals and keeps the pace.
• Decides when to escalate, to bring in more people or to call a rollback.
• Calls the incident mitigated and resolved, and ensures the review is scheduled.

What the commander does not do

The commander does not usually investigate or make the fix. The moment the commander starts typing commands, nobody is watching the whole picture. On a small team the commander may have to do some technical work, but it should be a conscious, temporary trade, and a deputy should take the coordination in the meantime.

The commander also does not need to be the most senior or the most technical person. They need to be calm, clear, willing to make decisions and trained in the role. Many teams rotate it among engineers, because the skill is learned by doing it.

The roles around the commander

Atlas models the roles used in the Incident Command System as adapted by software teams: incident commander, operations lead, communications lead, scribe, subject matter expert and liaison. One person may hold several. On a team of four, scribe and communications lead often collapse into one role. What matters is that every role has a named person and that the commander does not hold the operations role during a serious incident.

• Operations lead: directs the investigation and fix, and reports to the commander.
• Communications lead: owns the messages to stakeholders and customers, on the schedule the commander sets.
• Scribe: records the timeline as it happens, which spares the review from reconstructing it.
• Subject matter expert: advises on a specific system, joins and leaves as needed.
• Liaison: the point of contact with another team, a vendor or a customer.

How to start and hand over

Open by stating the role aloud: "I am taking incident commander." Confirm the severity, assign the operations lead and the communications lead, and set the time of the next status check.

Handovers are where information is lost. A response that lasts many hours will need a new commander. The outgoing commander should brief the new one on the current state, the actions in progress, the decisions made and the open questions, and then say explicitly that the role has transferred. Both should record the handover. Atlas keeps handovers of roles on the incident record, so anyone reading the timeline later can see who led at each point.

Training the role

• Hold short exercises in which a team handles a simulated incident, with someone playing the commander.
• Have new commanders shadow an experienced one before leading.
• Provide a one-page card that lists the opening steps, the questions to ask and the update cadence.
• Review the commander's decisions in the post-incident review, without attributing blame, to improve the role itself.