Incident Management Training for IT Operations

Level 1: Sprint 2

Exercise 2: IMS Briefing

Instructions

ROLES:

  • Incident Commander (IC):  Keeps the exercise moving, sets time limits and keeps group on track, and facilitates feedback among team members.
  • Liaison Officer (LNO):  For this exercise, ALL participants including IC will develop and deliver their own an IMS briefing based on a real or imaginary incident of their choosing. The incident can be IT-related, but doesn’t have to be.

OBJECTIVE:
Using the form below, write and submit a written IMS Briefing of ~200 words, including:

  • Introduction
  • 3 main points
  • Summary/Conclusion

(IMS Briefing examples are available at the bottom of the page if needed.) 

PARAMETERS:

  • As directed by the IC, each person delivers their briefing verbally to the small group.
  • The IC facilitates discussion and critique of each briefing after it is delivered.
  • Participants are encouraged to revise their written reports based on feedback received.
  • Once all members have delivered their reports, the leader facilitates discussion to choose one to represent the entire group.
  • The chosen LNO will deliver their IMS briefing in the main session after leaving the breakout room.
Do not submit this form until leaving the breakout room. If chosen as the LNO to represent your group, submit AFTER you deliver your briefing in the main room.

After you click Submit, immediately refresh your screen to see and continue editing your IMS Brieifing. If you navigate away from this screen, your work will no longer be visible here, but a copy will have been sent to your email.

IMS Briefing Examples

EXAMPLE #1

Introduction
<<Self introduction by name and function>>

<<Insert briefing number>>

I have two issues to update you on and my briefing is expected to last <<XXX>> minutes.

The first issue is regarding the Sev 1 incident currently in progress with our Core Production Release. The incident has caused users to be disconnected from the network.

The second point I will cover is our anticipated time to resolution.

Main Points [typically 2-3 main points]
As you know, at 22:00 PST we were alerted to an issue with a Core Production release. A script in this release led to subscribers being disconnected from the network. At this time, our team has identified the script that caused the incident. Currently, 30 subscribers are affected by this incident. We are in the process of further identifying the specific subscribers and our DBA group is developing a new script to run in order to restore service.

Second, I’d like to update you on the anticipated time to resolution. Based on the opinion of our Lead DBA, we anticipate the resolution to occur between 10:15 and 10:45 PST.

Summary/Conclusion
To conclude, we share your sense of urgency in resolving this incident and have identified the specific cause of the service interruption. We are in the process of resolving the issue and
declaring the incident ‘All Clear’, again estimating the window of resolution to be between 10:15 and 10:45 PST.

My next briefing will be at 10:45 PST. If there are any significant changes prior to that, I will notify you and schedule the briefing for an earlier time.

At this time, is there any additional information I can provide?

EXAMPLE #2

Good morning, this is Mary Jones, Group 1 Liason Officer.

The time is now 10:20 UTC. I have two issues to brief everyone on and this briefing is expected to take less than two minutes.

Here are the main points I will cover:

The first issue is that at 09:0150 UTC our customers began receiving error messages when attempting to login. Initially only five percent of our user base was affected but this number quickly escalated to one hundred percent. We are currently engaged with our support teams and are working to determine the cause of this problem.

The second item is that as we’re still working to determine the cause of this issue – there is no estimated resolution time, and the root cause is unknown.

In closing, we understand the severity of this issue and are working diligently to restore service to our customers. We intend to provide additional information as to the cause of this issue and our projected resolution time at our next briefing at 11:00 UTC.

Based on my briefing, is there any additional information I can provide?