What Counts as Major
Define criteria upfront: user impact, revenue impact, security implication, service criticality. Write them into a policy doc. An ad-hoc ‘manager calls it major’ process leads to inconsistent response.
The Bridge
Major incidents need a dedicated communication bridge — typically a Teams/Zoom room auto-created on MIM declaration. Integrate it via IntegrationHub so the bridge URL posts to the incident record.
Comms Cadence
Status updates every 30 minutes during the incident, even if the update is ‘still investigating’. Silence breeds escalation. Automate the reminder via scheduled job.
Bridge Leaders and Roles
Incident commander, scribe, tech lead, comms owner. One person, one role. In small teams, the commander can double as scribe, but only on low-complexity incidents.
Post-Incident Review
PIR within 5 business days. Timeline, root cause, corrective actions (with owners and due dates). Track corrective action completion — a PIR with unowned actions is a missed PIR.