Incident Management Training for IT Operations

IMS Briefing Example

Shown here are examples of how to structure a briefing, typically used by the person responsible for Communications to convey a succinct, effective message to key stakeholders outside the main resolution effort.

An IMS briefing has three main parts: Introduction, Main Points, Summary.

These are only examples and can be modified to fit any audience that needs more or different information than contained in a CAN report.

EXAMPLE #1

Introduction
<<Self introduction by name and function>>

<<Insert briefing number>>

I have two issues to update you on and my briefing is expected to last <<XXX>> minutes.

The first issue is regarding the Sev 1 incident currently in progress with our Core Production Release. The incident has caused users to be disconnected from the network.

The second point I will cover is our anticipated time to resolution.

Main Points [typically 2-3 main points]
As you know, at 22:00 PST we were alerted to an issue with a Core Production release. A script in this release led to subscribers being disconnected from the network. At this time, our team has identified the script that caused the incident. Currently, 30 subscribers are affected by this incident. We are in the process of further identifying the specific subscribers and our DBA group is developing a new script to run in order to restore service.

Second, I’d like to update you on the anticipated time to resolution. Based on the opinion of our Lead DBA, we anticipate the resolution to occur between 10:15 and 10:45 PST.

Summary/Conclusion
To conclude, we share your sense of urgency in resolving this incident and have identified the specific cause of the service interruption. We are in the process of resolving the issue and
declaring the incident ‘All Clear’, again estimating the window of resolution to be between 10:15 and 10:45 PST.

My next briefing will be at 10:45 PST. If there are any significant changes prior to that, I will notify you and schedule the briefing for an earlier time.

At this time, is there any additional information I can provide?

EXAMPLE #2

Good morning, this is Mary Jones, Group 1 Liason Officer.

The time is now 10:20 UTC. I have two issues to brief everyone on and this briefing is expected to take less than two minutes.

Here are the main points I will cover:

The first issue is that at 09:0150 UTC our customers began receiving error messages when attempting to login. Initially only five percent of our user base was affected but this number quickly escalated to one hundred percent. We are currently engaged with our support teams and are working to determine the cause of this problem.

The second item is that as we’re still working to determine the cause of this issue – there is no estimated resolution time, and the root cause is unknown.

In closing, we understand the severity of this issue and are working diligently to restore service to our customers. We intend to provide additional information as to the cause of this issue and our projected resolution time at our next briefing at 11:00 UTC.

Based on my briefing, is there any additional information I can provide?