cloudthinker-ai Major Incident Communication — IT
Incident: {{ incident_title }} | Severity: {{ severity }} Affected: {{ affected_services }} | Impact: {{ estimated_impact }} Channel: {{ communication_channel }}
Communication Timeline
INCIDENT DETECTED
│
├─ T+0 min: Initial notification (within 15 min of detection)
├─ T+30 min: First status update
├─ T+60 min: Hourly updates (SEV1) / 2-hour updates (SEV2)
├─ Resolution: Resolution announcement
└─ T+48 hrs: Post-incident summary (for SEV1/SEV2)
Template 1 — Initial Notification
Subject: [{{ severity }}] {{ incident_title }} — Service Disruption
IT SERVICE NOTIFICATION
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
We are aware of an issue affecting {{ affected_services }}.
WHAT IS HAPPENING:
[Brief description of the problem in non-technical language]
WHO IS AFFECTED:
{{ estimated_impact }}
WHAT WE ARE DOING:
Our IT team is actively investigating this issue and working
toward a resolution. We will provide updates every
[30 minutes / 1 hour] until this is resolved.
WORKAROUND (if available):
[Describe any temporary workaround, or "None at this time"]
NEXT UPDATE:
We will provide the next update by [time].
If you have questions, please contact the IT helpdesk at
[contact info]. Please do NOT submit individual tickets for
this issue — we are tracking it centrally.
IT Operations Team
Template 2 — Status Update
Subject: [UPDATE {{ update_number }}] {{ incident_title }}
IT SERVICE UPDATE #[number]
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
STATUS: [Investigating / Identified / Mitigating / Monitoring]
CURRENT SITUATION:
[What has been found or changed since last update]
AFFECTED SERVICES:
{{ affected_services }}
[Update if scope has changed]
WHAT WE ARE DOING:
[Current remediation actions in progress]
ESTIMATED TIME TO RESOLUTION:
[Provide estimate if possible, or "We are still assessing"]
WORKAROUND:
[Updated workaround if available]
NEXT UPDATE:
We will provide the next update by [time].
IT Operations Team
Template 3 — Resolution Announcement
Subject: [RESOLVED] {{ incident_title }}
IT SERVICE RESOLUTION
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
The issue affecting {{ affected_services }} has been RESOLVED.
DURATION:
[Start time] to [End time] ([total duration])
WHAT HAPPENED:
[Brief, non-technical explanation of what caused the issue]
WHAT WE DID:
[Brief explanation of how it was fixed]
WHAT YOU NEED TO DO:
[Any user actions needed, e.g., "Please restart your VPN client"
or "No action needed — service has been fully restored"]
PREVENTION:
We are taking steps to prevent this from recurring, including
[brief mention of preventive measures].
A detailed post-incident review will be shared within 48 hours.
We apologize for any inconvenience this may have caused.
IT Operations Team
Template 4 — Post-Incident Summary (SEV1/SEV2 only)
Subject: Post-Incident Summary — {{ incident_title }}
POST-INCIDENT SUMMARY
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
INCIDENT: {{ incident_title }}
SEVERITY: {{ severity }}
DURATION: [total duration]
IMPACT: {{ estimated_impact }}
TIMELINE OF EVENTS:
[HH:MM] Issue detected / first report
[HH:MM] IT team began investigation
[HH:MM] Root cause identified
[HH:MM] Fix implemented
[HH:MM] Service restored and verified
ROOT CAUSE:
[Non-technical explanation of what went wrong]
RESOLUTION:
[What was done to fix the issue]
PREVENTIVE MEASURES:
To prevent this from happening again, we are:
1. [Action item 1]
2. [Action item 2]
3. [Action item 3]
We value your patience during this disruption. If you
continue to experience issues, please contact the
IT helpdesk at [contact info].
IT Operations Team
Communication Checklist
Before Sending
- Have the facts been verified with the incident team?
- Is the language clear and non-technical for the audience?
- Is the severity level accurate?
- Has the communication been reviewed by incident commander?
- Is the affected scope correctly described?
Distribution
- Post to {{ communication_channel }}
- Update status page (if applicable)
- Notify executive stakeholders separately (for SEV1)
- Inform customer-facing teams (support, account management)
- Update IVR/phone system message if phone systems affected
After Resolution
- Send resolution announcement
- Close status page incident
- Schedule post-incident review
- Publish post-incident summary within 48 hours
Counter-Rationalizations
| Shortcut | Counter | Why |
|---|---|---|
| "We can skip some steps for this case" | Adapt the workflow steps, don't skip them | Skipped steps are where incidents and oversights originate |
| "The user seems to already know what to do" | Complete all workflow phases with the user | The workflow catches blind spots that experience alone misses |
| "This is a minor case, full process is overkill" | Scale the process down, don't turn it off | Minor cases become major when unstructured; the process scales, not disappears |
| "I'll fill in the details later" | Complete each section before moving on | Deferred details are forgotten; real-time capture is more accurate |
| "The template output isn't necessary" | Always produce the structured output format | Structured output enables comparison, audit trails, and handoff to other teams |
Output Format
Generate communications ready to send with:
- Appropriate template selected based on communication stage
- Filled-in details from incident information
- Distribution checklist for tracking delivery