cloudthinker-ai Incident Communication Template Skill
Manage communications for {{ incident_id }} ({{ severity }}) affecting {{ affected_service }}.
Workflow
Phase 1 — Initial Notification
INCIDENT DECLARATION
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] Incident ID: {{ incident_id }}
[ ] Severity: {{ severity }}
[ ] Affected service: {{ affected_service }}
[ ] Detected at: ___
[ ] Declared at: ___
[ ] Incident Commander: ___
[ ] Communications Lead: ___
INITIAL NOTIFICATION — INTERNAL
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Subject: [{{ severity }}] {{ incident_id }} — {{ affected_service }} impacted
We are investigating an issue affecting {{ affected_service }}.
- Impact: [describe user-facing impact]
- Start time: [when issue was first detected]
- Status: Investigating
- Incident Commander: [name]
- War room: [link to channel/bridge]
Next update in [30/60] minutes.
[ ] Sent to: #incidents channel — timestamp: ___
[ ] Sent to: engineering leadership — timestamp: ___
Phase 2 — Status Updates
STATUS UPDATE TEMPLATE — INTERNAL
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Subject: [{{ severity }}] {{ incident_id }} — Update #___
Current status: [Investigating / Identified / Monitoring / Resolved]
Summary:
- [What we know now]
- [What has changed since last update]
Impact:
- Users affected: ___
- Error rate: ___%
- Duration so far: ___
Actions taken:
- [Action 1]
- [Action 2]
Next steps:
- [What we are doing next]
Next update in [30/60] minutes.
UPDATE LOG
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Time | Update # | Status | Channel | Sent By
________|__________|______________|____________|________
| 1 | Investigating| Internal |
| 2 | | |
| 3 | | |
Phase 3 — Customer-Facing Communication
CUSTOMER NOTIFICATION — STATUS PAGE
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Title: {{ affected_service }} — Service Disruption
[Investigating]
We are currently investigating reports of [impact description].
Some users may experience [specific symptoms].
We will provide updates as we learn more.
Posted: ___
[Identified]
We have identified the cause of the {{ affected_service }} disruption.
Our team is implementing a fix.
Posted: ___
[Monitoring]
A fix has been implemented and we are monitoring the results.
Service is recovering and most users should see improvement.
Posted: ___
[Resolved]
This incident has been resolved.
{{ affected_service }} is operating normally.
Duration: ___
We apologize for any inconvenience.
Posted: ___
COMMUNICATION DECISION MATRIX
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Severity | Status Page | Customer Email | Social Media | Press
SEV1 | YES | YES | CONSIDER | CONSIDER
SEV2 | YES | TARGETED | NO | NO
SEV3 | OPTIONAL | NO | NO | NO
Phase 4 — Leadership Briefing
EXECUTIVE SUMMARY
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Incident: {{ incident_id }} ({{ severity }})
Service: {{ affected_service }}
Duration: ___
Customer impact: ___
Revenue impact: $___
Root cause: [one sentence summary]
Resolution: [one sentence summary]
Preventive measures: [one sentence summary]
[ ] Sent to leadership: [ ] YES — timestamp: ___
Phase 5 — Resolution Announcement
RESOLUTION — INTERNAL
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Subject: [RESOLVED] {{ incident_id }} — {{ affected_service }}
{{ incident_id }} has been resolved.
Timeline:
- Detected: ___
- Declared: ___
- Root cause identified: ___
- Fix deployed: ___
- Resolved: ___
- Total duration: ___
Root cause: [brief description]
Fix applied: [brief description]
Impact:
- Users affected: ___
- Requests failed: ___
- Revenue impact: $___
Next steps:
- Post-incident review scheduled: ___
- Action items will be tracked in: [ticket/doc link]
Phase 6 — Post-Incident Summary
POST-INCIDENT COMMUNICATION
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] Post-incident review completed: ___
[ ] Customer-facing post-mortem published (if required):
[ ] What happened
[ ] Impact
[ ] Root cause
[ ] What we are doing to prevent recurrence
[ ] Internal post-mortem shared
[ ] Action items assigned and tracked:
- ___: owner: ___ due: ___
- ___: owner: ___ due: ___
[ ] Communication retrospective:
- Updates were timely: [ ] YES [ ] NO
- Messaging was accurate: [ ] YES [ ] NO
- All audiences reached: [ ] YES [ ] NO
- Improvements for next time: ___
Counter-Rationalizations
| Shortcut | Counter | Why |
|---|---|---|
| "We can skip some steps for this case" | Adapt the workflow steps, don't skip them | Skipped steps are where incidents and oversights originate |
| "The user seems to already know what to do" | Complete all workflow phases with the user | The workflow catches blind spots that experience alone misses |
| "This is a minor case, full process is overkill" | Scale the process down, don't turn it off | Minor cases become major when unstructured; the process scales, not disappears |
| "I'll fill in the details later" | Complete each section before moving on | Deferred details are forgotten; real-time capture is more accurate |
| "The template output isn't necessary" | Always produce the structured output format | Structured output enables comparison, audit trails, and handoff to other teams |
Output Format
Produce an incident communication package with:
- Communication timeline (all messages sent with timestamps)
- Audience-specific messages (internal, customer, leadership)
- Status page updates (chronological entries)
- Resolution announcement (root cause, fix, prevention)
- Communication retrospective (what worked, what to improve)