Incident Management Training for IT Operations

Level 1: Sprint 2

200-Word IMS Briefing Exercise

Mission Objective:
Produce a written briefing of approximately 200 words using the IMS briefing format:

  • Introduction
  • 3 main points
  • Summary/Conclusion

Breakout Room details:
Upon arrival in the breakout room, immediately identify a person to lead the exercise. All other team members will develop briefing documents.

Exercise Parameters:

  • Each team member writes (on paper or electronically) a 200 word briefing document.
  • Upon completion, each member delivers the report to the breakout group.
  • The leader facilitates a critique of each report amongst all team members.
  • If needed, the report is revised based on the feedback.
  • Once all members have completed their reports, the leader facilitates a discussion to choose one briefing to represent the entire group.
  • This briefing will be delivered in the main session at the conclusion of the breakout

IMS Briefing Examples


<<Self introduction by name and function>>

<<Insert briefing number>>

I have two issues to update you on and my briefing is expected to last <<XXX>> minutes.

The first issue is regarding the Sev 1 incident currently in progress with our Core Production Release. The incident has caused users to be disconnected from the network.

The second point I will cover is our anticipated time to resolution.

Main Points [typically 2-3 main points]
As you know, at 22:00 PST we were alerted to an issue with a Core Production release. A script in this release led to subscribers being disconnected from the network. At this time, our team has identified the script that caused the incident. Currently, 30 subscribers are affected by this incident. We are in the process of further identifying the specific subscribers and our DBA group is developing a new script to run in order to restore service.

Second, I’d like to update you on the anticipated time to resolution. Based on the opinion of our Lead DBA, we anticipate the resolution to occur between 10:15 and 10:45 PST.

To conclude, we share your sense of urgency in resolving this incident and have identified the specific cause of the service interruption. We are in the process of resolving the issue and
declaring the incident ‘All Clear’, again estimating the window of resolution to be between 10:15 and 10:45 PST.

My next briefing will be at 10:45 PST. If there are any significant changes prior to that, I will notify you and schedule the briefing for an earlier time.

At this time, is there any additional information I can provide?


Good morning, this is Mary Jones, Group 1 Liason Officer.

The time is now 10:20 UTC. I have two issues to brief everyone on and this briefing is expected to take less than two minutes.

Here are the main points I will cover:

The first issue is that at 09:0150 UTC our customers began receiving error messages when attempting to login. Initially only five percent of our user base was affected but this number quickly escalated to one hundred percent. We are currently engaged with our support teams and are working to determine the cause of this problem.

The second item is that as we’re still working to determine the cause of this issue – there is no estimated resolution time, and the root cause is unknown.

In closing, we understand the severity of this issue and are working diligently to restore service to our customers. We intend to provide additional information as to the cause of this issue and our projected resolution time at our next briefing at 11:00 UTC.

Based on my briefing, is there any additional information I can provide?