It's 2:04 AM. Slack is on fire. Nobody knows who is driving.
That's the moment a small team loses the most money — not because the bug is hard, but because the first 30 minutes have no structure. Here's the exact checklist we run, minute by minute. Steal it.
Minute 0–5: Declare, don't debate
-
One sentence in the incident channel:
[SEV1] Checkout erroring — Investigating — @you drives - Name the Incident Driver (one person, out loud). If nobody's named, the loudest person will do three jobs badly.
- Freeze deploys. No pipeline merges until the driver says so. Half of outages get longer because a second change lands mid-investigation.
Minute 5–15: Stabilize, don't solve
- Rollback first. If the last deploy touched anything near the blast radius, roll it back. "But is that really the cause?" — doesn't matter. Roll back, then diagnose.
- Check the boring killers in this order: disk full → certs expired → config drift → dependency down. They cause most small-team outages and they're all under 2 minutes to check.
- Capture evidence as you go: timestamps, error rates, one screenshot of the dashboard. Future-you will need it.
Minute 15–30: Communicate on a clock
- Post a stakeholder update — even if it says nothing new:
Still investigating. Impact: checkout down. Next update 2:35. - A timestamped promise beats silence every time. Silence is what turns an outage into a churn event.
- If it's customer-facing, your status page gets a line before your first tweet does.
After: the 3 artifacts that stop the repeat
- A one-page timeline — what happened, when, who did what. 15 minutes to write, saves hours of "wait, why did we think it was DNS?"
- The missing runbook. Whatever you had to figure out live, write down while it's fresh.
- One monitoring gap closed. The thing that failed silently this time gets a check this week.
The honest problem with checklists
Reading this at 2 AM won't help. It has to already exist as files your team opens without thinking.
That's exactly why we packaged the First 30 Minutes system — the full 12-template kit (declare script, comms templates, timeline doc, the 2 AM triage sheet, postmortem form) plus the disk/cert/config watchdog scripts:
👉 Ops Starter Kit — $14 on Gumroad — instant download, use with any stack.
The first 30 minutes template alone (free): The First 30 Minutes.
If this saved you one messy incident, it paid for itself. If you want more of these playbooks, the full bundle lives on the storefront.
Written by the ops team behind HIVE Ops Lab. We sell checklists and scripts that we run in production — no theory, no vendor pitch.
Top comments (0)