Open About this eBook

Incidents are inevitable. In today's fast-paced, always-on world, we depend more on technology than ever. Whether it’s a system-wide outage, a cybersecurity breach, or a short-term glitch in service, every organization will face moments that require clear and effective communication with the people who are impacted. 

While you can’t control when incidents happen, you can control how prepared you are. What sets the best teams apart is not just how quickly they resolve incidents, but how effectively they communicate throughout the entire process.

Incident communication is more than just relaying updates. It’s about building trust, managing expectations, and minimizing confusion during high-stress and high-stakes situations.

In a hyper-connected society where digital communication is unavoidable, customers, stakeholders, and business teams rely on real-time information. Clear and timely communication can make the difference between a frustrated customer and a loyal one.

About this eBook

This

Open Watchtowers and fire signals

Incidents have occurred throughout history for as long as humans have lived. Fires, natural disasters, pandemics, wars, and infrastructure issues are all examples of early-day incidents. As technology has become prevalent and people are more connected, how humans respond to and communicate during incidents has evolved.

To examine the evolution of incident communication, we must look at how incident management practices have changed over time.

Watchtowers and fire signals

Many centuries ago, communities would use watchtowers to detect potential incidents and serve as a first line of defense. Soldiers staffed these watchtowers and were responsible for responding to any signs of trouble. They relayed in

Open Incident Command System (ICS)

Incident Command System (ICS)

Fast-forward to the 1970s. Initially developed for California wildfire response, the Incident Command System (ICS) standardized incident response by introducing common terminology, defining clear roles and responsibilities, establishing effective communication channels, and emphasizing thorough documentation. 

The ICS emphasizes communication as a critical component of effective incident management, explicitly calling attention to the following best practices:

• Keep information clear and to the point to avoid any confusion.
• Use a variety of channels – like radios, status boards, and emails – to ensure everyone stays in the loop.
• Set regular update intervals to keep everyone aware of the latest developments.
• Ensure all messages are aligned and approved by the Incident Commander or the designated lead.

Since then, the ICS has been adopted across various sectors, including public safety, healt

Open National Incident Management System

National Incident Management System (NIMS)

The events of September 11 highlighted the critical need for national standards in incident operations. In 2004, the National Incident Management System surfaced as a standardized approach for managing emergencies and incidents across all levels of government, private sector organizations, and non-governmental organizations. 

NIMS is a much more comprehensive approach to managing, responding, and communicating about incidents, and it encourages the following communication practices:

• Make sure systems work together so agencies can easily coordinate.
• Share real-time, consistent info to keep everyone on the same page.
• Use clear, standardized protocols for smooth communication.
• Rely on tools like radios and digital platforms to stay connected.
• Keep public messaging accurate and consistent through a Public Information Officer.

This holistic approach to incident mana

Open Incident communication today

Incident communication today

Incident communication and the overall practice of incident management look much different today than in years and centuries prior. While we don’t rely on flags and fire signals, the essence of these approaches is still present. 

Modern incident communication draws from the past to deliver a more streamlined and efficient experience leveraging technology. In software, organizations rely heavily on monitoring, alerting, and communication systems to reach the right people at the right time with relevant information. 

Here’s how incident communication operates today:

• Real-time alerts: Automated systems send immediate alerts to relevant teams and stakeholders. 
• Multi-channel updates: Status pages, social media, email, and in-app notifications ensure clear communication across diverse audiences.
• Human-centric messages: Updates are written with empathy and clarity, emphasizing transparency and building trust.
• Pre-defined playbooks: Teams rely on pre-written comm

Open Pioneers of modern incident management

Pioneers of modern incident management

Modern incident management draws inspiration from the past but owes much of its recent evolution to the bold experimentation of tech pioneers. Here are some key players worth noting:

Steve Capps: Developer of the “monkey.” In 1983, an Apple Macintosh engineer, Steve Capps, developed a “monkey” that generated a series of rapid-fire random user interface inputs. The monkey proved to be a valuable testing tool for identifying failures in software applications, eventually inspiring the idea of “chaos engineering” and the “chaos monkey.”

Jesse Robins: Creator of “game day” In the early 2000s, Amazon engineer Jesse Robins, known as the “Master of Disaster,” created a program called Game Day. The idea was to simulate real-world incidents by introducing significant failures in so

Open Defining an incident

Being prepared for incidents is critical for effective communication. Pre-incident planning aligns your team with the tools and processes to respond effectively while keeping stakeholders informed. 

All great incident response teams start with a plan. Think of this as the pre-work to nailing how you communicate during incidents.

Define an incident & set severity levels

A clear definition of "incident" and a solid understanding of severity levels set your team up for success from the start. Without this alignment, your team won’t be able to respond in a unified way.

Defining an incident

First, you need to know what scenarios qualify as an incident. Defining what an incident means to your organization gets everyone on the same page and ensures incidents are declared consistently. 

A clear definition distinguishes incidents from bugs, prevents unnecessary escalations, streamlines your response process, and ensures resources are allocated appropriately. 

Sorry’s definition of an inci

Open Define communication channels

Define communication channels

Determine the tools and platforms you’ll use for updates to ensure consistent and effective communication. How will you gather the contacts if you need to reach a specific subset of customers? What communication systems will your team need to be trained on and have access to? 

Identify key stakeholders

Determine individuals or groups who might be impacted by or need to know about incidents. For each severity type, you might have different groups of people. Think of customers, end-users, team leads, and executives. 

Establish internal communication practices

Effective internal communication helps your team make informed choices throughout the lifecyle of an incident. For example, an account executive might be preparing for a demo with a potential client when a critical server goes down. Without notice, the demo would be a trainwreck because

Open Common roles

Incident roles define who is responsible for what so everyone knows where to focus during an incident. Roles bring order to the incident response process and ensure your team is set up to communicate timely and effectively.

Common roles

Every team has different needs and operates accordingly. However, these are some of the most common roles in incident management:

Incident commander

Every incident needs an incident commander or incident lead. This person is responsible for overseeing the entire incident response process. For more minor incidents, the incident commander might even handle stakeholder communication.

Communications lead

For larger teams or more complex incidents, a dedicated communications lead can help ensure timely and consistent messaging to stakeholders. They might handle external and internal communication across various channels. This role is often led by someone from the customer support or success team. The communications lead must be a skilled writer and be able

Open Documentation and training

Documentation and training

Incident roles should be well-documented, and training should be conducted to ensure everyone is clear about their roles and responsibilities before an incident occurs. Here are some tips:

Include incident training in new-hire onboarding: This instills the importance of incident management from day one.

Document roles and responsibilities: Write a short description of each role and store it in your company wiki or anywhere accessible to all team members.

Conduct regular fire drills or mock incidents: Run through mock incidents regularly so everyone can get a refresher of what’s expected of them.

Open Common incident communication channels

Effective incident communication involves aligning internal teams for a swift and coordinated response while keeping external stakeholders informed to build trust and manage expectations. 

Internally, centralized communication platforms help teams share updates, assign roles, and collaborate without confusion or redundancy. Externally, dedicated channels, such as status pages or customer support ticketing systems, enable teams to respond and set expectations at scale.

Common incident communication channels:

• Status pages: A centralized place for incident communication.
• Team chat: For internal teams to communicate in real-time.
• Alerting platforms: So internal teams are notified of potential issues.
• Social media: To inform your followers of known issues.
• Email notifications: To reach a targeted group, often powered by status page notifications.
• Text notifications: To reach a targeted group, often powered by status page notifications.
• Documentation: For c

Open Internal & External communication

Internal communication: keeping your team aligned

Jumping into an active software incident is like being dropped into a high-stakes escape room where the clock is ticking, the lights are flickering, and half the team has different pieces of the puzzle. Reliable communication systems are a must-have when managing incidents and being prepared to update customers. 

Here are some standard tools used by teams to communicate about incidents internally:

INTERNAL INCIDENT COMMUNICATION TOOLS

External communication: Keeping your customers informed

As a customer, encountering a software incident is like being stuck in traffic on a busy highway without knowing what’s causing the jam or how long it will last. Frustration builds as you watch the clock tick and wonder if you’ll ever reach your destination. The difference between a terrible and tolerable experience lies in the inform

Open Incident communication tips

Once you have your team and communication channels ready to go, you need to be ready to communicate when things go wrong. We’ve compiled our favourite incident communication tips from 50 years of combined incident management experience:

Communicate early

Acknowledge the incident when you’re confident it’s a valid issue. It’s okay to be vague if you don’t have many details. Inform your audience that you’re investigating the problem and will provide more information as soon as you have it.

Update often

To keep all stakeholders informed, provide regular updates, even if progress is minimal. The more you communicate, the more you’ll reduce uncertainty and avoid negative speculation. Set a cadence for regular updates and stick to it.

Use plain language

Use simple, straightforward language that everyone can understand. Avoid technical jargon or overly complex explanations to ensure clarity and avoid confusion. Simple language builds trust and helps all stakeholders stay informed and aligned.

**

Open Conduct a post-incident review

What truly sets resilient teams apart is not only how they handle the heat of the moment but also what they do afterward. The post-incident phase is an opportunity to reflect, learn, and improve so that teams can be even more prepared the next time things go wrong. 

Here are some common tasks after an incident is resolved:

Conduct a post-incident review

An incident retrospective, or post-incident review, is a structured process for reflecting on and analyzing incidents. Post-incident reviews bring the team together to identify lessons learned and opportunities for improvement. 

Traditionally, these are referred to as postmortems. However, many incident management practitioners have moved away from that term because of its association with death, which can feel counterproductive in collaborative environments. 

The post-incident review is an excellent opportunity to raise customer concerns and see how communication can be improved both internally and externally. 

Document and share learn

Open Moving forward with confidence:

Moving forward with confidence: mastering incident communication

As explored throughout this eBook, effective communication is essential for maintaining trust and minimizing the impact of unexpected service disruptions. Good incident communication is driven by preparedness, empathy, transparency, and clarity.

Remember, the goal is not just to resolve the issue at hand but to build stronger relationships with your audience through thoughtful, timely, and honest communication. By mastering incident communication, you’ll be able to effectively reduce customer frustration and maintain trust even during challenging moments.

We hope you found this eBook helpful. Feel free to share it with a colleague or make it part of your own incident response training program.

Open About Sorry™

We launched Sorry™ in 2014 to help companies improve customer communication during outages. Our incident communication platform is used by a variety of industries globally, including technology, healthcare, government, and more.

By providing real-time updates, templates, and the ability to send email and SMS notifications, Sorry™ provides a stress-free way for businesses to acknowledge incidents promptly, reducing customer frustration and building trust. 

Interested in learning more about Sorry? Schedule a demo today!

Open Sources

Sources: 

https://devops.com/the-evolution-of-incident-management/

https://spike.sh/blog/history-and-evolution-of-incident-management/

https://rootly.com/blog/a-primer-on-the-history-and-evolution-of-incident-management-to-today

https://www.fema.gov/txt/nims/nims_ics_position_paper.txt

https://artsandculture.google.com/story/the-fortified-towers-wall-platforms-and-watchtowers-of-the-great-wall-simatai-great-wall-tourist-area/SAVhLZQwDXng7Q?hl=en

https://www.usda.gov/sites/default/files/documents/ICS100.pdf

https://www.fema.gov/emergency-managers/nims

https://folklore.org/Monkey_Lives.html?sort=date

https://www.itnews.com.au/feature/what-is-chaos-engineering-the-art-of-breaking-things-purposefully-555100

https://www.gremlin.com/chaos-monkey/the-origin-of-chaos-monkey