Incident Management Training for IT Operations

Level 1: Sprint 2

CAN Report Examples


Hello, I’m ________, your Liaison Officer for this incident.

At 09:53 PST, after returning a server host to the pool, all of the hosts became unresponsive resulting in a loss of access to email and websites.

1. Server team accessing the server hosts directly to look for possible causes.
2. Server team spinning up user directory server in the cloud to restore access to email.

1. Submit an urgent ticket with VMware for their assistance.
2. Retrieve logs from servers, ready to submit to VMware when they respond.

This is the end of my report.


Hello, I’m ________, your Liaison Officer for this incident.

At 17:00 Hour, 20 applications are reporting that users located in the western part of the United States are unable to login. 2500 users are impacted.

SREs have determined that a recent code deploy broke the authentication instance used by these users and rollback has been initiated and will be completed in 10 mins.

We are waiting for rollback to completed and these impacted instances to rebooted. Next CAN report will be in 17:40 Hours.

This is the end of my report.

Exercise 1: CAN Reports



Incident Commander (IC):  Keeps the exercise moving, sets time limits and keeps group on track, and facilitates feedback among team members.

Liaison Officer (LNO):  For this exercise, ALL participants including IC will develop and deliver their own CAN Report based on an incident of their own choosing (doesn’t have to be IT-related).

OBJECTIVE: Using the form below, write and submit a written report using the Conditions, Actions, Needs format. 


  • As directly by the IC, each person delivers their briefing verbally to the small group.
  • The IC facilitates a group discussion and critique of each briefing after it is delivered.
  • Participants are encouraged to revise their written reports based on feedback received.
  • Once all members have delivered their reports, the IC facilitates discussion to choose one person to deliver their briefing as LNO in the main room.

If you are chosen to deliver your report in the main room, click Submit AFTER your briefing.
All others please click Submit before leaving the breakout room.

If you accidentally click Submit before you are ready, you may be able to get your report back by  immediately refreshing your screen. If you navigate away from this screen, your work will no longer be visible here, but a copy will have been sent to your email.