Incident Management for Operations

Chapter 5. Unified Command (UC)

Complex, high-severity incidents that create serious impact across multiple business units geographic territories or functional areas require an expanded version of IMS. These incidents generally need high-level business or policy decisions that will impact the entire business and are beyond the scope of an IC implementing IMS to resolve a technology incident. Unified Command is a group of senior business and technology leaders who establish a common set of objectives and strategies and a single incident action plan, which is implemented by the Incident Commander and IRT.

Larger companies, especially enterprise companies, may find challenges in communications and span of control when an incident involves multiple business units, functional areas, environments, or teams with unique—sometimes conflicting—goals (for example, operations and security) or any other kingdoms that exist within the organization.

The word kingdom in this context describes a business unit or other entity within a company. To that end, Unified Command (UC) is most effective when an incident requires engagement and communication among multiple kingdoms across the company.

Note

IMS is used to manage individuals and teams within a kingdom. UC is used to manage across kingdoms within an organization.

Not all companies will need to implement UC if incidents typically only involve a small number of incident responders, do not cut across kingdoms, or do not result in serious business ...