Understanding the competencies and practices that define successful incident response is key. Here’s a breakdown of the core practices across competencies and what stars you should aim for in each area to excel in incident management.

1. Identify Scope
Skills related to understanding the incident and effectively communicating findings to stakeholders, ensuring correct resolution and prioritisation.

• Stars to Aim For:
  • Ask questions to validate the impact of the problem. Ensure that all stakeholders understand the breadth and severity of the issue.
  • Form a working theory. Develop an initial hypothesis about the root cause and the affected components.
  • Attempt to reproduce the issue. Confirm that the reported issue can be reliably triggered.
  • Qualify the problem. Determine whether the incident meets the criteria for escalation.
  • Reproduce the incident. Verification ensures clarity in diagnosis and response.
  • Use metrics as evidence. Data-driven insights provide credibility and focus.

2. Incident Mechanics
Focuses on essential admin activities during an incident, ensuring no critical steps are missed and maintaining a record to prevent future issues.

• Stars to Aim For:
  • Incident created. Ensure every incident is documented with a clear summary and unique identifier.
  • Formally assign criticality level. Assess and communicate the urgency and impact of the incident.
  • Send first comms in the first 5 minutes. Timely updates reduce anxiety and maintain trust.
  • Encourage business comms. Keep the business informed with concise, jargon-free updates.
  • Confirm resolution with the business. Validate that the solution meets expectations before closing the incident.
  • Cross-check resolution with stakeholders. Ensure all relevant parties agree the issue is resolved.
  • Send regular business communications. Keep stakeholders in the loop with updates at regular intervals.

3. Internal Comms:
Covers communication skills among team members involved in resolving the incident, including specific actions and behaviours.

• Stars to Aim For:
  • Use metrics as evidence. Back up assertions with data to keep discussions objective.
  • Check changes done to the platform. Ensure all modifications are logged and accounted for.
  • Review changes. Confirm that changes align with resolution strategies.
  • Form an effective investigation team. Gather the right people with the right skills to address the issue.
  • Take command. Ensure there is a clear leader to coordinate efforts and make decisions.
  • Escalate when required. Don’t hesitate to involve higher levels of support or expertise when needed.
  • Ask team members to provide evidence of their assertions. Encourage accountability and focus.
  • Communicate clearly and frequently. Keep everyone aligned and informed throughout the process.
  • Track actions and timebox them. Avoid delays by assigning clear deadlines for each task.
  • Focus on restoration over root cause analysis. Prioritise getting systems back online before diving into detailed investigations.
  • Validate the fix. Ensure the problem is truly resolved before concluding the incident.
  • Cross-check resolution with the team. Collaboratively confirm that all aspects of the issue are addressed.

4. External Comms:
Involves communication behaviours with the wider business and third parties during an incident, ensuring everyone is informed and aligned.

• Stars to Aim For:
  • Send first comms in the first 5 minutes: Aim to provide an initial update to external stakeholders promptly after the incident is identified. This builds trust by showing that the situation is under control.
  • Encourage business comms: Keep the business informed with concise, jargon-free updates.
  • Send regular business comms: Provide consistent updates at pre-defined intervals or as new information emerges in the business comms channel.  This keeps external stakeholders informed about progress and resolution efforts.
  • Confirm resolution with the business: Ensure that business stakeholders are informed of and agree on the resolution and its communication.
  • Cross-check resolution with stakeholders: Verify with relevant internal and external stakeholders that the fix has addressed the issue entirely. This step ensures alignment before closing the communication loop.
  • Use facts over opinions: Provide facts (data) driven updates to stakeholders

5. Command Incident
Skills required to lead an incident, coordinating efforts for quick, safe resolution while staying calm and decisive.

• Stars to Aim For:
  • Form a working theory. Establish a starting point for investigation and resolution.
  • Ask team members to provide evidence of their assertions. Foster a culture of accountability.
  • Form an effective investigation team. Ensure the right expertise is involved to handle the incident.
  • Know your team and their roles. Leverage each member’s strengths for maximum effectiveness.
  • Take command. Provide clear direction and maintain control of the incident.
  • Escalate when required. Recognise when additional support is necessary and act accordingly.
  • Manage actions and timings. Keep tasks on track to minimise downtime.
  • Facts over opinion. Base decisions and communications on verifiable information.

Each competency practice highlights essential skills that build confidence and expertise in incident management. By aiming for stars in these areas, you can ensure a structured, data-driven, and effective approach to handling incidents, reducing downtime, and fostering trust across teams and stakeholders