Incident Communications
During an incident, communications reduce uncertainty. Be honest, frequent enough, and free of blame and speculation presented as fact.
Channels
| Channel | Traits |
|---|---|
| Status page | short, timestamped, impact + next update time |
| Customer email | clearer narrative, who is affected, what to do |
| Internal | more detail, war-room links, roles |
Workflow
- Confirmed facts only: impact, start time, scope, workaround.
- Separate known vs investigating.
- Next update time commitment.
- Customer actions (if any).
- Resolve message when mitigated; promise post-incident follow-up without fake RCAs.
Output format
## Status update — <timestamp UTC>
**Impact:** …
**Current status:** investigating | identified | monitoring | resolved
**What we know:** …
**What we are doing:** …
**Workaround:** …
**Next update by:** …
Rules
- Never invent root cause; "under investigation" is valid.
- No humor that minimizes customer pain.
- Security incidents: minimize exploit detail in public channels.
- Match severity cadence (more frequent when impact is high).
- Align public wording with legal/support guidance when provided.
- Engineering postmortems are a different skill (
incident-postmortems).
Edge cases
- Partial degradation: be specific about who is affected.
- False alarm: brief resolve with apology for noise if customers saw it.
- Prolonged incident: rolling updates without repeating empty filler.