Back to lesson

Major Incident Management Drill

Slide 1: Major Incident Management Drill

On-screen

Major Incident Management Drill

Staying calm when systems fail

Narration

Anna: Welcome to our major incident drill. Think of it as a fire drill for IT—everyone needs to know their part before the real emergency hits.
Greg: We'll walk through a simulated outage so you can practice the motions without the adrenaline spike. The goal is to stay calm and restore service swiftly.

Slide 2: When is it a major incident?

On-screen

When is it a major incident?

  • Impacts critical business services
  • Requires cross-team coordination
  • Needs immediate communication

Narration

Greg: A major incident is more than a glitch. It affects core services and usually drags multiple teams into the fight. Picture the checkout system rejecting every payment during a sale—that's major.
Anna: When you see widespread impact or a breached SLA on the horizon, escalate it and rally the right experts immediately.

Slide 3: Example scenario

On-screen

Example scenario

  • Checkout system fails across all regions
  • Users can't complete purchases
  • Mobilize database, network and app teams

Narration

Anna: Example scenario focuses attention on a concrete part of the work. Checkout system fails across all regions, Users can't complete purchases, and Mobilize database, network and app teams.
Greg: In practice, ask who owns the work, what evidence proves it happened, and what handoff comes next. Use the supporting details as a checklist: Users can't complete purchases; Mobilize database, network and app teams.

Slide 4: Checkout architecture

On-screen

Checkout architecture

  • Web front end served from CDN
  • API gateway routing to microservices
  • Payment gateway integration
  • Inventory and order databases
  • Monitoring at each layer

Narration

Anna: Let's map the checkout flow so everyone knows where problems can start.
The web front end hits an API gateway, which then fans out to microservices for
payments, inventory, and orders. Those services talk to a clustered database and
ping the payment provider over the internet. Monitoring agents watch each step.

Slide 5: Who is involved?

On-screen

Who is involved?

  • Incident commander coordinates the response
  • Communications lead keeps stakeholders informed
  • Front-end and backend engineering teams
  • Database administrators
  • Network operations
  • Payment provider liaison
  • Service desk and customer support

Narration

Greg: A failure anywhere in that chain kicks off a big response.
The incident commander coordinates efforts and sets priorities.
A communications lead keeps executives and customers in the loop.
Front-end and backend engineers dig into code issues.
Database admins check queries and replication.
Network ops verify connectivity and DNS.
A liaison talks to the payment provider.
Finally, the service desk fields user reports and keeps them updated.

Slide 6: Running the drill

On-screen

Running the drill

  • Assign clear roles fast
  • Follow the runbook step by step
  • Capture decisions and timelines

Narration

Anna: During the drill, assign each role quickly and follow the runbook.
The incident commander leads, comms handles updates, and a scribe logs every step.
Greg: Treat it as the real thing—no shortcuts. The more accurately you rehearse,
the smoother an actual outage will play out.

Slide 7: After-action review

On-screen

After-action review

  • Share what went well and what didn't
  • Update the playbook accordingly
  • Schedule the next practice

Narration

Greg: Once the dust settles, gather the team to review what happened. Share successes, missteps, and any surprises.
Anna: Update the playbook based on those lessons and book another drill. Practice turns panic into muscle memory.