LEARN. PRACTICE. GROW.Concept and mechanism
A useful update explains what is affected, what is known, what is being done, and when more information will follow. Distinguish a confirmed cause from a hypothesis and an estimate from a commitment. If there is no evidence-based ETA, state that it remains undetermined and schedule the next update. This lets the business plan without turning a guess into a promise. Adapt detail and channel to the audience: technical responders need operational evidence; users need impact and approved alternatives. Avoid exposing sensitive data in broad channels. Vendor communication intervals are examples of their processes and should be adapted to local commitments and criteria.
Guided application
Maintain a timeline with timezone, source, and a distinction between observation and action. In an original exercise, impact begins at 09:00 UTC, detection occurs at 09:07, response is acknowledged at 09:10, and recovery is validated at 09:35. Detection took seven minutes, acknowledgement took three additional minutes, and impact lasted 35 minutes; using only the interval after detection understates unavailability. Define boundaries before calculating indicators and avoid the acronym MTTR without explaining the chosen meaning. The scribe records decisions, executors, outcomes, and follow-ups rather than transcribing every spoken sentence. Use the incident identifier to link tickets and updates, preserving traceability of claims and subsequent corrections.
09:00 to 09:35 is 35 minutes of impact even if the alert arrived only at 09:07.
Common pitfalls
Invented ETA; hypothesis as fact; timestamps without timezone; measuring only from the alert.
Related topics: Triage and impact · Coordination and responsibilities · Diagnosis and mitigation
Communicate what evidence supports and make the next update predictable.
Reference: Scoped communication and recovery confirmation · Incident management practices 2026-09; scoped Google SRE, PagerDuty and Atlassian examples