DEV Community

Hive80-lab
Hive80-lab

Posted on

What to say in the first 15 minutes of an outage (template inside)

#devops #sre #management #communication

What to say in the first 15 minutes of an outage (template inside)

There are two jobs during an outage: fixing the system and telling humans what's happening. Engineers obsess over the first. But a broken status page and silent Slack channels cost more trust than ten extra minutes of downtime.

The first 15 minutes decide whether people see you as a team with a problem, or a team that hides problems.

The three sentences that matter

Before you touch a keyboard, you owe your stakeholders three sentences:

  1. We know. "We are aware of the issue affecting X." (Say it within 5 minutes, even if the diagnosis is unknown.)
  2. We're on it. "The on-call team has engaged and is investigating." (Name the role, not the person.)
  3. We'll update you. "Next update at HH:MM, or sooner if anything changes." (A concrete time. Then beat it.)

That's the whole bridge message. No cause speculation, no apologies that admit nothing, no internal codenames.

The first-15-minutes timeline

  • 0–3 min: Acknowledge. Pin a bridge thread. Freeze deploys.
  • 3–7 min: Assign one comms owner — NOT the person debugging. One voice.
  • 7–12 min: Post the three sentences to status page + affected channels.
  • 12–15 min: Set the update cadence (30 min steady state, 15 min while degraded).

The template 

STATUS: Investigating — <service> degraded for <who, where>
IMPACT: <what users cannot do, in plain words>
ACTIONS: on-call engaged, <n> engineers on bridge, deploys frozen
NEXT UPDATE: HH:MM (or sooner if status changes)
Enter fullscreen mode Exit fullscreen mode

Fill in brackets, paste, done in 90 seconds. The discipline isn't the template — it's refusing to skip the update-time line. An update time converts anxiety into patience.

What NOT to say early

  • "Everything is down" unless it is. Scope precisely: "checkouts in the EU app."
  • Root cause guesses. "A recent change" is a cause; "we suspect the DB" is a rumor.
  • "Should be back soon." You don't know. It reads as dismissive when you're wrong.

We use exactly this structure in the Ops Starter Kit — alongside the incident one-pager and the severity table it plugs into. It was built for teams of 1–50 with no security staff, on the theory that a system one tired person can actually operate beats a sophisticated one they can't.

If you want the free version first: the First 30 Minutes checklist is free at https://hive80lab.gumroad.com/l/first-30-minutes — it walks the first half hour of an incident step by step. And everything in the kit is 30% off this month with coupon HIVE-LAUNCH30 at checkout:

Top comments (0)