The First Ten Minutes

Continuity plans are usually thorough. They name roles, list dependencies, set thresholds and define escalation paths. Then an incident starts at 6:40 on a Tuesday morning and the first ten minutes are spent on something the plan does not address: working out who is actually available.

The plan assumed a duty roster. The roster is current. The mobile number on it is two jobs out of date.

Reachability is the real capability

Most organisations can describe what they would do in a disruption. Fewer can demonstrate that they can reach the people required to do it, on the channels those people actually use, within the window the plan assumes.

That is a testable thing, and it degrades quietly. People change roles, phones and locations. A contact list that was accurate at the last review drifts every month after it, and nothing in normal operations reveals the drift. The first time it is tested for real is the one occasion where being wrong is expensive.

The organisations that hold up well treat the contact graph as live operational data rather than an appendix — sourced from the systems that already know when somebody changes role, and exercised often enough that failures show up on a quiet day.

Targeted beats broadcast

The instinct under pressure is to tell everybody. It feels responsible and it is usually counterproductive. A message to the whole organisation about an issue affecting one site generates a wave of questions from people who cannot help, all arriving while the people who can are trying to work.

Targeting requires knowing who is affected — by site, by role, by system dependency. That is work done before the incident, not during it. It is also the difference between a communication that reduces load and one that adds to it.

Record the decision, not just the event

Timelines are usually reconstructed afterwards from messages and memory. What gets lost is the reasoning: not that a site was closed at 08:15, but why that call was made, on what information, by whom.

Reasoning is what the post-incident review needs, what a regulator asks for, and what the next team facing something similar can actually learn from. Capturing it in the moment costs very little — a note against the decision as it is taken. Trying to recover it a fortnight later costs a great deal and produces something less truthful.

None of this makes an incident go well. It makes the difference between a response that spends its first ten minutes responding and one that spends them getting organised.