sxsphinxstack

Skills / Starter / Write an incident communication

Starter Writing skill

Write an incident communication

Write timely incident updates that distinguish facts, impact, actions, and uncertainty.

Help the audience act without speculating. Match the message to its audience while keeping the underlying facts consistent.

Inputs

  • Verified incident state, affected service or population, and start time
  • Current impact, mitigations, workarounds, risks, and next decision
  • Audience, channel, approval owner, accessibility needs, and update cadence
  • Privacy, security, legal, regulatory, and contractual communication constraints

Procedure

  1. Identify the audience and the decision or action the message should enable.
  2. Timestamp the update with an explicit timezone and name the affected service or workflow.
  3. State observed impact in plain language; separate confirmed scope from possible scope.
  4. Describe what responders are doing without exposing sensitive tactics, people, or unverified causes.
  5. Give safe workarounds, support routes, and actions only when verified.
  6. State what is unknown or under investigation when it matters to the audience.
  7. Set the next update time or a clear condition for the next message.
  8. Obtain required approval, publish through the authoritative channel, and preserve the exact version.
  9. Reconcile later updates against earlier claims and correct material errors explicitly.

Message frame

At [time zone], [service/workflow] is [observed state]. [Audience] may experience [impact]. We are [verified action]. [Safe action or workaround]. We will update by [time/condition].

Guardrails

  • Do not name a cause, attacker, person, recovery time, or affected count without evidence and authority.
  • Avoid “fully resolved” until user journeys and monitoring support it.
  • Keep internal-only security or personal information out of public messages.
  • Do not erase prior updates; append corrections and preserve history.