Incidents compress hours of decision-making into minutes. Without a playbook, teams reinvent process under stress — skipping customer communication, duplicating investigation work, and forgetting to capture timeline data for postmortems. A 30-minute playbook does not replace judgment; it removes the need to remember basics when adrenaline is high.
Minute zero through five: acknowledge and assemble. Whoever sees the alert first declares an incident in Acme and Slack — even if severity is uncertain. Early declaration beats late escalation. Assign three roles immediately: Incident Commander (coordinates), Communications Lead (status page and stakeholders), and Technical Lead (investigation). One person can hold two roles in small teams, but names must be explicit in the channel topic.
Minutes five through fifteen: triage with evidence. Open the Acme alert panel — it links correlated metrics, recent deploys, and error log spikes. State a working hypothesis aloud in the incident channel: "Checkout latency up 400% since deploy abc123." Assign one investigator per hypothesis maximum; parallel unfocused digging wastes people. Update severity if customer impact scope changes.
Minutes fifteen through twenty-five: mitigate first, root-cause second. Roll back, scale up, feature-flag off, or fail over — pick the fastest path to stop bleeding. Document every action with timestamps in the Acme incident timeline. Future you (and auditors) will need the sequence, not just the outcome.
Minutes twenty-five through thirty: communicate externally. Even if the fix is in progress, post a status page update: what customers experience, what you are doing, and when you will update again. Helios Health reduced support ticket volume 60% during outages by posting within 25 minutes consistently — customers tolerate downtime better than silence.
After mitigation, resist closing the incident immediately. Move to monitoring mode for at least one error-budget window. Secondary failures often appear when primary load shifts to backup systems. Keep the incident channel open with reduced staffing until SLIs return to normal.
Blameless postmortems within five business days. Use Acme's auto-generated incident summary as a draft — it pulls timeline events, key graphs, and participant list. Focus on systemic improvements: missing alerts, unclear runbooks, slow rollback paths. Action items need owners and due dates or they become postmortem theater.
Run game days quarterly. Inject failure in staging — or carefully in production with feature flags — and time your team against the 30-minute playbook. Apex Financial's last game day exposed that their Communications Lead lacked status page credentials; fixing that took ten minutes and prevented a real incident embarrassment.
Templates accelerate consistency. Acme provides incident severity definitions, Slack channel naming conventions, and customer email templates in the SRE Handbook. Copy them once; refine for your org; stop writing from scratch at 2 AM.
Reliability is a habit, not a heroism contest. Teams that follow a structured first 30 minutes resolve incidents faster, communicate better, and retain engineers who might otherwise burn out on chaotic nights. Download the handbook, schedule a game day, and make the playbook muscle memory before your next real page.