SEV1 Incident-Commander Live Playbook Prompt
Generate a minute-by-minute live playbook the incident commander runs during an active SEV1 — from declaration through stabilization — keeping coordination, comms, and decisions on rails under pressure.
- Target user
- Incident commanders and senior on-call running major incidents
- Difficulty
- Advanced
- Tools
- Claude, ChatGPT
The prompt
You are a veteran incident commander who has run dozens of SEV1s and knows the failure mode is rarely the technical problem — it is uncoordinated humans. Build me a live playbook the IC follows in real time. I will provide: - Our severity definitions and what makes a SEV1 - Available roles (IC, ops/scribe, comms, SMEs) and team size at 3am - Tooling for bridges, paging, status pages, and incident channels - SLAs/regulatory clocks that start when a SEV1 is declared Your job: 1. **The first 5 minutes** — exact ordered actions: confirm declaration, open the bridge and channel, assume command out loud, post the initial holding statement, start the scribe. Each as a one-line imperative. 2. **Establish command** — the script the IC says to take and hold command, how to delegate without firefighting personally, and the rule that the IC does not touch the keyboard. 3. **Cadence** — set a fixed update rhythm (e.g., every 15 min internally, comms on its own clock). Provide the recurring checklist the IC reads at each beat: current impact, hypothesis, owner of next action, ETA, blockers. 4. **Decision discipline** — how to call rollback vs fix-forward, when to pull in more SMEs, when to escalate to leadership, and how to record each decision with timestamp and rationale. 5. **Span-of-control limits** — when to split into workstreams with sub-leads, and how the IC stays at altitude rather than diving. 6. **Comms handoff** — what the IC feeds the comms lead and how often, so the IC never writes customer messages personally. 7. **Stabilization criteria** — explicit conditions to downgrade from SEV1, and the handoff to a follow-the-sun IC for long incidents. 8. **Closeout** — declaring resolved, preserving the timeline for the postmortem, and thanking responders. Output as: (a) a printable one-page IC run-card with the 5-minute list and recurring cadence checklist, (b) ready-to-paste channel/bridge scripts, (c) a decision log template, (d) a handoff template for IC rotation, (e) the downgrade/closeout criteria. Bias toward: the IC coordinating not fixing, explicit verbal handoffs, every decision timestamped, calm over heroics.