Incident Response Roles & RACI

Owns the incident end-to-end. Coordinates all activities, drives the bridge call, makes escalation decisions, and ensures communication flows.

Key responsibilities

• •Declare and classify the major incident
• •Run the incident bridge/war room
• •Coordinate across technical teams
• •Make escalation and communication decisions
• •Ensure timeline is documented
• •Drive post-incident review

The senior technical person leading the investigation and resolution effort. Works closely with the MIM to translate technical findings into status updates.

Key responsibilities

• •Lead technical investigation and diagnosis
• •Coordinate resolver groups
• •Propose and validate remediation options
• •Assess risk of proposed fixes
• •Provide technical status to MIM

Manages all stakeholder communications, both internal and external. Ensures timely, accurate, and audience-appropriate messaging.

Key responsibilities

• •Draft and send stakeholder updates
• •Manage status page and social media (if applicable)
• •Coordinate with PR/legal for external communications
• •Maintain communication log
• •Handle VIP/exec inquiries

Captures the real-time timeline of events, decisions, and actions. This record is critical for the post-incident review.

Key responsibilities

• •Document all events with timestamps
• •Record decisions and rationale
• •Track action items and owners
• •Maintain the running incident log
• •Prepare initial PIR draft

Represents the business impact perspective. Helps prioritize based on customer and business impact, and coordinates business-side workarounds.

Key responsibilities

• •Assess business and customer impact
• •Prioritize resolution efforts from business perspective
• •Coordinate business-side workarounds
• •Communicate to business stakeholders
• •Approve comms to customers/partners