Explain like I'm five · SRE

What is an Incident Commander?

Incident commander, told as a story about the one person who picks up the baton when a big incident hits.

I'll fix it!no, let me!nobody's telling us anythinga big incident hits — everyone tries to fix it alone, and nobody tells the guests anything

A big incident hits, and everyone tries to fix it alone.Nobody decided what to tell the guests either, so it gets even more chaotic.

everyone's in a hurry, giving different orders at oncedoing different things at once during an incident tangles everything up

Everyone's in a hurry, doing different things at once.During an incident, that just tangles things up more.

STATUS PAGEinvestigating nowwhen an incident grows, one person picks up the batonthat person decides who does what — and handles the guest updates too

When an incident grows, one person picks up the baton.That person decides who does what, and handles the guest updates too.

One commander for a big incidentno crowd of voices at once
Doesn't fix it directlyhands off, orders only
Guest updates tooowns the status page
Set by severity, in advancewho commands is decided ahead of time
under one incident commander, roles split upCOMMANDFIXWATCHCOMMSupdating guestscommand only coordinates — fixing, watching, and talking to guests are split among others

Command only coordinates — fixing, watching, and talking to guests are split among others.It's not one person doing everything — the roles are split.

calling a commander even for a small hiccupthat's actually slowerSEVERITY TABLESEV1: call a commanderSEV2: on-call handles itSEV3: just log itdecide in advance, matched to the incident's size

Calling a commander for a small incident just slows things down.Grade incidents by size and decide who leads ahead of time.

In one breath

Incident commander = when a big incident hits, one person picks up the baton, splits up the roles, and owns the guest communication too.

The role that leads incident response — not fixing things directly, but coordinating who does what and owning external communication like the status page. It matters to decide in advance, by severity level (SEV1 and up), when a commander gets called in.

When grown-ups say it

Incident commander
The one holding the baton. Doesn't fix things directly — only coordinates.
Severity levels (SEV1~)
Grades that classify how big an incident is. SEV1 is the biggest.
Role separation
Splitting command, fixing, and communication. No one person carries it all.
Status page
The board that tells guests what's going on. The commander owns this update.
Incident declaration criteria
The line that decides when something counts as an incident. Deciding it in advance avoids confusion.
Incident resolution
The official word that everything's okay again. The commander declares it, and that's when it ends.
On-call
Whoever's holding the pager this week. Sometimes becomes the commander. → whoever's holding the pager
Postmortem
The blameless record written after it's over. The commander makes sure this gets written too. → the record everyone writes without blame
Next story
The Mechanic's Notebook →
Want another term as a picture book? Request →