Incident Management for Operations

Chapter 3. The Incident Commander (IC)

Readers who’ve been working in IT operations roles may have participated in many incidents as a responder, but may or may not have had the opportunity to lead an incident. If you have had the pleasure, you know it can be a stressful and overwhelming endeavor. If you haven’t, there will likely come a day when you’ll be called upon to do so. Leading an incident is challenging and mentally taxing, especially in situations where the solution to the issue isn’t obvious, the pressure is on, and time is ticking away.

Dealing with the multitude of personalities both on and off the incident conference call bridge can be as challenging as figuring out the solution to a tough technical issue. Some people may question or criticize your decisions while others openly praise your leadership. Your actions may be quietly, or, in some cases, not so quietly, second-guessed. After the incident is over and the cause of it becomes clear, some may question why it took so long to resolve. Of course, if you had all the answers at the beginning of an incident that you do at the end, you may have made different decisions.

Ultimately, you will earn some sort of reputation as an Incident Commander (IC; Figure 3-1). It may be good or bad, but it will certainly follow you as well as precede you to every incident response you lead. It is therefore critical that you and your IRT start with a solid foundation and adopt a few key principles.

Figure 3-1. Just like a fire ...