Major Incident Management: When Normal Process Is Not Enough
A major incident is one whose impact is large enough that the normal process cannot handle it. It calls for a different level of organisation, set up before it is needed.
A major incident is an incident with significant impact on the business or its customers, large enough that the ordinary process for handling incidents is not sufficient. It is the top of the severity scale: the level at which the response is no longer one person with a pager but a coordinated team.
Define the trigger
Write the criteria down and tie them to your severity scale, for example the highest one or two levels. Typical triggers are unavailability of a core service for most customers, a security incident involving data, a failure affecting a contractual commitment or an event drawing external attention. Allow anyone to declare, and allow the commander to downgrade.
Set up the response
- Name an incident commander at once, who does not investigate.
- Open a single coordination space, a call or a channel, and keep it for the response only.
- Assign an operations lead, a communications lead and a scribe. Add subject matter experts as needed.
- Page the people the severity requires, and make sure the escalation path is working. Simulate your escalation policy beforehand.
- Tell leadership, with a named person responsible for the relationship to executives so that the commander is not interrupted.
Run it on a cadence
Set a fixed cycle. Every thirty minutes, for example, the commander asks each lead for status, decides the next steps and the communications lead sends an update. Keep the cycle even when nothing has changed. The structure reduces anxiety, keeps decisions flowing and prevents everyone from asking for updates at once.
Plan for length. A major incident can run for many hours. Arrange relief for responders, hand over roles explicitly and keep the timeline current so that a new arrival can read it. Atlas keeps role handovers on the incident record, and its timeline records every change and message.
Communicate to more audiences
Major incidents typically need messages to customers, to staff, to leadership and sometimes to regulators or partners. Draft the first customer message early and have it approved. Atlas requires approval of the exact text before an update is emailed to affected customers. If personal data may be involved, involve your legal and privacy advisers at once, since notification duties may apply. Atlas offers regulatory notification clocks as a scheduling aid and states that they are not legal advice.
After the incident
- Declare mitigation when customer impact ends and resolution when the cleanup is done. Keep them distinct.
- Hold a full review within days, with leadership informed of the outcome.
- Produce a short written summary for customers about what happened and what is changing.
- Track the follow-up actions to completion, with an executive sponsor for the largest.
- Run an exercise that tests the changes.