Running a Major Incident in the Workspace
On this page
In this lesson, you will learn:
- The major incident manager’s job
- The tools Daniel uses in the workspace
- How child incidents and tasks help
- What “one source of truth” means
🔁 Quick look back: Last time: Proposing and Promoting a Major Incident. You learned how an agent proposes a major incident candidate and the major incident manager accepts or rejects it.
1 “What’s the latest?”
The email outage has been going for 30 minutes.
- Five people are fixing it, each in a different chat.
- Nobody knows what’s been tried.
- Anita asks for an update, and gets three different answers.
👉 The fix: run the major incident in one place, with a timeline everyone can see.
2 Daniel’s tools
3 How it fits together
| Tool | Why Daniel uses it |
|---|---|
| Timeline | One story everyone can read, instead of five chats |
| Bridge call | The team talks live; key points go into the timeline |
| Child incidents | Every caller is linked, and updated at once |
| Tasks | Each team knows exactly what it owns |
| Emergency change | The fix is controlled, even in a hurry |
📝 Note: You’ll build the emergency change CHG0030046 in the Change Types chapter.
💡 Good to know: The major incident manager leads and communicates. He doesn’t fix it himself. That’s the job of Arjun’s team.
4 One source of truth
When Anita asks “what’s the latest?”, the answer is always the same: look at INC0010150.
⭐ Remember: One major incident, one timeline, one leader.
5 Quick recap
- The major incident manager leads and communicates
- The timeline is the single story of what happened
- Child incidents link every caller
- Tasks give each team clear work
- The fix goes through an emergency change
6 Check yourself
Think of your answer first. Then tap to check.
1 Does Daniel fix the email server himself? Show answer
No. He leads and communicates. Arjun’s team fixes it.
2 Where does Anita get the latest update? Show answer
From the major incident record, INC0010150.
3 How are the 40 callers kept updated? Show answer
Their incidents are children of the major incident, updated with the parent.
4 How is the failover fix controlled? Show answer
Through an emergency change, CHG0030046.
Nice work! You know how a major incident is run. 🎉
Next up: Incident Communication Plans
Was this lesson helpful?
Please log in to share lesson feedback.
Have a question or doubt?
Ask here and get help from instructors and fellow learners.
Only logged-in learners can post.
