Playbook

Data Incident Triage Form & Communication Playbook

Interactive triage form, owner assignments, templated stakeholder communications, and a post-incident RCA checklist to shorten detection-to-recovery time and improve repeatable incident handling.

Interactive Tool

Data Incident Triage & Communication Playbook

Purpose

This interactive triage form helps teams quickly capture the essential facts, assign ownership, coordinate containment, and notify the right people when a data, analytics, or model incident occurs. Use it to shorten time-to-detection and recovery, preserve important triage data, and make post-incident analysis easier.

How to use

  1. Fill the fields you know now — partial entries are OK.
  2. Assign an initial owner and take immediate containment actions.
  3. Use the communication templates below to notify stakeholders rapidly.
  4. Save the triage; use the stored record to drive RCA and follow-up tasks.

Communication templates (quick copy)

Engineering / Response Team

Subject: [Incident] {incident_id || ID} — {classification} affecting {impacted_metrics}

Summary: Detected at {detection_time}. Impact: {scope} — impacted metrics: {impacted_metrics}.

Initial owner: {initial_owner} ({owner_team}). Immediate containment: {containment_actions}

Requested action: Triage, contain, and restore. Updates every 30 min or on status change.

Business / Product Stakeholders

Subject: Data incident affecting {impacted_metrics}

Summary: We detected an issue at {detection_time} that may affect reporting and decisions based on {impacted_metrics}. Engineering is investigating. Impacted scope: {scope}.

Owner: {initial_owner}. Expected update: in 60 minutes or sooner.

Executive

Subject: Incident alert — {classification} impacting {impacted_metrics}

One-sentence summary of impact, affected customers/teams, and current mitigation plan. Owner: {initial_owner}.

A short unique identifier (use existing ticket ID if available).
When the problem was first noticed or alarm triggered. ISO timestamp or human-readable time.
Who detected/reported the issue.
Best way to reach the reporter for follow-up.
Choose the primary detection channel.
List affected dashboards, KPIs, tables, or models. Be specific (table.column or dashboard name).
Choose the best single option that describes where the issue is visible.
If different from detection time, when the problem likely began.
Use severity to prioritize resources. Update if it changes.
Best current guess of root cause category.
Who will lead the immediate response? Make someone accountable.
Team responsible for response.
What was done already to limit impact (rollback, stop pipeline, revert model, switch to fallback data).
Short, time-boxed next actions (e.g., run data backfill, escalate to SRE, open ticket).
Select who should be informed immediately.
Choose a template to copy into your notification channel.
Where and how you notified stakeholders (Slack #channel, email, incident page).
If yes, create a ticket that links to this triage record and assign owner.
Decide now whether a full RCA and action plan are needed.
Person responsible for the post-incident RCA.
Target date for RCA completion.
After the incident, summarize root cause, corrective actions, and lessons learned.
You can explore this tool now. Sign in or create an account to save your responses and return to them later.
Sign In to Save Create an Account
Make this tool part of your work

Save a personal copy, bring it to your team, or tailor the questions and workflow to fit what you are hungry to improve.

Member customization and team collaboration are coming soon.
Discuss Ask the Librarian

Discussion

Comments and conversation will live here.