Incident Response Plan Template: role 1 commander

## Role: Incident Commander (IC)

### Description

The Incident Commander (IC) acts as the single source of truth of what is currently happening and what is going to happen during an major incident.  The IC is the highest ranking individual on any incident call, regardless of their day-to-day rank.  They are the decision maker during an incident; they delegate tasks and listen to subject matter experts to resolve the incident.  Their decisions made as commander are final.

Your job as an IC is to evaluate the situation, provide clear guidance and coordination, recruiting others to gather context/details. **Do not perform any investigation or remediation:** delegate these tasks.

### Duties

Resolve the incident as quickly and as safely as possible using the incident response plan as a framework: lead the team to investigate, remediate, communicate.  Use the Deputy to assist you, and delegate to relevant liaisons and experts (SMEs) at your discretion.

1. Help prepare for incidents,
    * Setup communications channels for incidents.
    * Funnel people to these communications channels when there is a major incident.
    * Train team members on how to communicate during incidents and train other Incident Commanders.
1. Drive incidents to resolution,
    * Get everyone on the same communication channel.
    * Collect information from team members for their services/area of ownership status.
    * Collect proposed repair actions, then recommend repair actions to be taken.
    * Delegate all repair actions, the Incident Commander is NOT a resolver.
    * Be the single authority on system status
1. Facilitate calls and meetings,
    * Gain consensus (Poll During a Decision)
    * Provide status updates
    * Reduce scope (dismiss attendees when possible)
    * Spin off sub-teams
    * Transfer command when necessary
    * Sign off calls
    * Maintain order
    * Get straight answers
    * Handle executive swoop such as
        * Overriding the Incident Commander
        * Anti-motivation
        * Information requests
        * Questioning severity
    * Handle disruptive or belligerent responders
1. Post Mortem,
    * Creating the initial template right after the incident so people can put in their thoughts while fresh.
    * Assigning the post-mortem after the event is over, this can be done after the call.
    * Work with Team Leads/Managers on scheduling preventive actions.

The Incident Commander uses some additional call procedures and lingo:

* Always announce when you join the call if you are the on-call IC.
* **Do not** let discussions get out of hand. Keep conversations short.
* Note objections from others, but your call is final.
* If anyone is being actively disruptive to your call, kick them off.
* Announce the end of the call.
* After an incident, communicate with other training Incident Commanders on any debrief actions you feel are necessary.

**Use clear terminology, and avoid acronyms or abbreviations. Clarity and accuracy is more important than brevity.**

### Training

* Read the incident response plan, including all roles and playbooks.
* Participate in an incident response exercise.
* Shadow a current incident commander without actively participating, keeping your questions until the end.
* Reverse shadow a current incident commander.  Respond to incidents with the current IC there to take over if necessary.
* _OPTIONAL:_ facilitation training
* _OPTIONAL:_ Refer to [Incident Responders as Facilitators (and Therapists)](#FIX) and the [PagerDuty Incident Commander training](https://response.pagerduty.com/training/incident_commander/) for more ideas and discussion.

#### Prerequisites

There is no seniority or business-unit prerequisites to become an Incident Commander, it is a role open to anyone with the training and ability.  Before you can be an Incident Commander, it is expected that you meet the following criteria:

* Excellent verbal and written **communication skills**.
* **High-level knowledge** of business infrastructure and functions.
* Excellent critical thinking, judgment, and decision-making.
* Flexibility and ability to **listen to expert feedback**, modifying plans as necessary.
* **Participated in at least two incident responses**.
* Gravitas, ability to **take command**, and **willingness to kick people off a call** to remove distractions, even if it's the CEO.

Deep technical knowledge is not required!  Incident Commanders do not require deep technical knowledge of our systems. Your job as Incident Commander is to coordinate the response, not make technical changes. Don’t think you can’t be an Incident Commander just because you’re not in the engineering department.

#### Graduation

Upon completion of training, add yourself to the Incident Commander roster.