Your incident ran 4 hours. The next engineer took over at shift change. By morning, half the context was gone — the wrong half.
Handoffs are where incidents lose the plot. Not at 2 AM when the pager fires: at 4 AM when the incoming on-call asks "so what have we tried?" and the answer is a wall of Slack nobody can parse under pressure.
After auditing dozens of post-incident reviews, the pattern is boring and consistent: teams don't lose incidents to complexity, they lose them to unshared state. Here's the minimal handoff protocol that fixes it — 4 fields, 60 seconds to update, readable at 4 AM with adrenaline in your veins.
The 4-field incident handoff
1. CURRENT BELIEF — One sentence: what we think is happening right now. Example: "Checkout latency — we believe it's DB connection pool exhaustion after the 23:40 deploy."
2. LAST ACTION + TIME — What changed last and when. "Rolled back deploy #4412 at 02:10. Latency dropped 30%, not fully recovered."
3. NEXT ACTION + OWNER — "Priya: raising DB max_connections 200→400 in staging to confirm hypothesis. ETA 02:35."
4. NOT TRIED (the killer field) — The list of things explicitly ruled out. "NOT: DNS (tested, resolves in 8ms). NOT: upstream API (p99 90ms, normal)."
That fourth field is the one that saves your night. Half of incident thrash is the incoming engineer re-testing things the outgoing one already eliminated — because the ruled-out list lived in someone's head or a scrollback nobody will read.
Why this survives contact with a real night
Every field passes one test: can a tired human act on it in 10 seconds? Belief, last action, next action, not-tried. No timelines, no tool dumps, no "see thread."
The discipline cost is tiny: update the block every ~30 minutes or after any meaningful action. We tape the template at the top of the incident channel and update it in place — one message, always current, always findable.
The pattern behind the pattern
Notice what all 4 fields are: state, not history. Most incident docs record history (timeline). Humans fighting a fire need the current model of the system, plus the boundary of what's been excluded. History is for the review; state is for the fight.
This same principle — separating "what we believe now" from "what happened then" — is why good runbooks read like checklists with a diagnosis section, not like narratives.
Steal the template
This 4-field handoff ships inside the Incident Runbook Pack — alongside the first-30-minutes ransomware checklist and the 12-point security audit — in the Ops Starter Kit:
→ Ops Starter Kit: https://hive80lab.gumroad.com/l/ops-starter-kit
→ Automation Starter Pack: https://hive80lab.gumroad.com/l/automation-starter-pack
→ Full store: https://hive80lab.gumroad.com
No signup wall. Copy the 4 fields into your incident channel today; upgrade to the full pack when your next postmortem blames "communication."
What's your handoff field #5? Drop it in the comments — the best one gets folded into the free template.
Top comments (0)