Prepare an incident handover before an incident
A contact list works only when it is tied to decisions.
Choose a concrete rehearsal
Use an exercise such as a lost administrator account or an unavailable file service. State clearly that it is an exercise and agree participants in advance. Do not trigger unsolicited tests against third-party systems. Describe what the first person notices and which service they believe is affected.
Write the first fifteen minutes
List the person who receives the report, the person who can restrict access and the person authorised to make a business interruption decision. Record an alternative communication route if the affected service is also the usual chat or email tool. Keep account recovery instructions in the approved secure store rather than copying secrets into the handover document.
Preserve a useful record
The exercise log should distinguish observations, assumptions and actions. Note timestamps with a timezone. Keep the original alert text and record which evidence was preserved by an authorised operator. Do not encourage staff to explore systems outside their access rights or to overwrite logs while trying to fix the issue.
Close the loop
At the end of the rehearsal, choose a small set of corrective actions with owners and dates. Re-run the failed handover step after it is repaired. A plan that has only been read is different from a plan that has been exercised. Report that difference honestly when a customer asks about readiness.
References provide background. The working methods and fictional examples here are our editorial guidance, not an endorsement by the referenced organisations.
Put this into practice: open the worksheet →