Incident Management for Operations

Chapter 4. Scaling the Incident Response

Incident Response and Escalation

Small incidents with low impact typically require less people and management framework, and perhaps rely more on problem solving by individuals. Large problems with high impact typically require more incident responders, more management framework, more teamwork, more tasks to complete and track, more stress, and more business impact to consider. These larger incidents generally require a robust management framework to stay organized and a stronger Incident Commander to keep the effort moving forward in a clear and purposeful manner.

There is no perfect management formula for either situation and no hard-and-fast rules. It’s up to each Incident Commander to create the right mixture of command and framework to create the most effective incident resolution environment, which is matched to the size and scope of the incident. Part of being a good Incident Commander is the ability to know how to expertly mix the elements of command, framework, and problem-solving.

In some cases, it may appear unnecessary to adhere to a formal command structure on what seems like a minor issue (green- or yellow-box issue), but think of it this way: each incident response reinforces the use of the process for all incident responders because skill and proficiency are mastered by repetition.

If IMS is only activated for large incidents (red- or black-box incidents), those skills and proficiencies may not be there to rapidly and ...