Develop incident commanders through structured observation, realistic drills, explicit handoffs, supervised command, and evidence-based readiness reviews.
Write incident updates that remain useful without a recovery estimate by stating current impact, remaining uncertainty, concrete actions, and the next communication checkpoint.
Coordinate simultaneous incidents around shared dependencies while preserving distinct customer impact, responder ownership, recovery criteria, and historical incident identity.
Run incident command with one to four responders by making combined roles explicit, protecting operational attention, and splitting responsibilities before coordination fails.
