# Major Incident Communication It

> Use when performing major incident communication it — iT-wide incident communication workflow for notifying end users and stakeholders during major IT outages or service disruptions. Covers initial impact notification, periodic status updates, resolution announcements, and post-incident summaries with templates for each communication stage.

- Skill: `cloudthinker-ai/major-incident-communication-it` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cloudthinker-ai/major-incident-communication-it`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cloudthinker-ai/major-incident-communication-it/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Productivity
- Author: cloudthinker-ai (https://skillmd.com/u/cloudthinker-ai)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/cloudthinker-ai/major-incident-communication-it

---


# Major Incident Communication — IT

Incident: **{{ incident_title }}** | Severity: **{{ severity }}**
Affected: {{ affected_services }} | Impact: {{ estimated_impact }}
Channel: {{ communication_channel }}

## Communication Timeline

```
INCIDENT DETECTED
    │
    ├─ T+0 min:   Initial notification (within 15 min of detection)
    ├─ T+30 min:  First status update
    ├─ T+60 min:  Hourly updates (SEV1) / 2-hour updates (SEV2)
    ├─ Resolution: Resolution announcement
    └─ T+48 hrs:  Post-incident summary (for SEV1/SEV2)
```

## Template 1 — Initial Notification

**Subject:** [{{ severity }}] {{ incident_title }} — Service Disruption

```
IT SERVICE NOTIFICATION
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

We are aware of an issue affecting {{ affected_services }}.

WHAT IS HAPPENING:
[Brief description of the problem in non-technical language]

WHO IS AFFECTED:
{{ estimated_impact }}

WHAT WE ARE DOING:
Our IT team is actively investigating this issue and working
toward a resolution. We will provide updates every
[30 minutes / 1 hour] until this is resolved.

WORKAROUND (if available):
[Describe any temporary workaround, or "None at this time"]

NEXT UPDATE:
We will provide the next update by [time].

If you have questions, please contact the IT helpdesk at
[contact info]. Please do NOT submit individual tickets for
this issue — we are tracking it centrally.

IT Operations Team
```

## Template 2 — Status Update

**Subject:** [UPDATE {{ update_number }}] {{ incident_title }}

```
IT SERVICE UPDATE #[number]
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

STATUS: [Investigating / Identified / Mitigating / Monitoring]

CURRENT SITUATION:
[What has been found or changed since last update]

AFFECTED SERVICES:
{{ affected_services }}
[Update if scope has changed]

WHAT WE ARE DOING:
[Current remediation actions in progress]

ESTIMATED TIME TO RESOLUTION:
[Provide estimate if possible, or "We are still assessing"]

WORKAROUND:
[Updated workaround if available]

NEXT UPDATE:
We will provide the next update by [time].

IT Operations Team
```

## Template 3 — Resolution Announcement

**Subject:** [RESOLVED] {{ incident_title }}

```
IT SERVICE RESOLUTION
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

The issue affecting {{ affected_services }} has been RESOLVED.

DURATION:
[Start time] to [End time] ([total duration])

WHAT HAPPENED:
[Brief, non-technical explanation of what caused the issue]

WHAT WE DID:
[Brief explanation of how it was fixed]

WHAT YOU NEED TO DO:
[Any user actions needed, e.g., "Please restart your VPN client"
 or "No action needed — service has been fully restored"]

PREVENTION:
We are taking steps to prevent this from recurring, including
[brief mention of preventive measures].

A detailed post-incident review will be shared within 48 hours.

We apologize for any inconvenience this may have caused.

IT Operations Team
```

## Template 4 — Post-Incident Summary (SEV1/SEV2 only)

**Subject:** Post-Incident Summary — {{ incident_title }}

```
POST-INCIDENT SUMMARY
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

INCIDENT:        {{ incident_title }}
SEVERITY:        {{ severity }}
DURATION:        [total duration]
IMPACT:          {{ estimated_impact }}

TIMELINE OF EVENTS:
[HH:MM] Issue detected / first report
[HH:MM] IT team began investigation
[HH:MM] Root cause identified
[HH:MM] Fix implemented
[HH:MM] Service restored and verified

ROOT CAUSE:
[Non-technical explanation of what went wrong]

RESOLUTION:
[What was done to fix the issue]

PREVENTIVE MEASURES:
To prevent this from happening again, we are:
1. [Action item 1]
2. [Action item 2]
3. [Action item 3]

We value your patience during this disruption. If you
continue to experience issues, please contact the
IT helpdesk at [contact info].

IT Operations Team
```

## Communication Checklist

### Before Sending
- [ ] Have the facts been verified with the incident team?
- [ ] Is the language clear and non-technical for the audience?
- [ ] Is the severity level accurate?
- [ ] Has the communication been reviewed by incident commander?
- [ ] Is the affected scope correctly described?

### Distribution
- [ ] Post to {{ communication_channel }}
- [ ] Update status page (if applicable)
- [ ] Notify executive stakeholders separately (for SEV1)
- [ ] Inform customer-facing teams (support, account management)
- [ ] Update IVR/phone system message if phone systems affected

### After Resolution
- [ ] Send resolution announcement
- [ ] Close status page incident
- [ ] Schedule post-incident review
- [ ] Publish post-incident summary within 48 hours

## Counter-Rationalizations

| Shortcut | Counter | Why |
|----------|---------|-----|
| "We can skip some steps for this case" | Adapt the workflow steps, don't skip them | Skipped steps are where incidents and oversights originate |
| "The user seems to already know what to do" | Complete all workflow phases with the user | The workflow catches blind spots that experience alone misses |
| "This is a minor case, full process is overkill" | Scale the process down, don't turn it off | Minor cases become major when unstructured; the process scales, not disappears |
| "I'll fill in the details later" | Complete each section before moving on | Deferred details are forgotten; real-time capture is more accurate |
| "The template output isn't necessary" | Always produce the structured output format | Structured output enables comparison, audit trails, and handoff to other teams |

## Output Format

Generate communications ready to send with:
1. **Appropriate template** selected based on communication stage
2. **Filled-in details** from incident information
3. **Distribution checklist** for tracking delivery