The 5-Minute Incident Triage System
When an incident fires, the first 5 minutes determine everything. Most small teams waste those minutes on confusion: "Is this real?" "Who's looking at it?" "What should I do first?"
After responding to 200+ incidents, I built a triage system that takes 5 minutes and saves hours.
The Triage Checklist (Print This)
Minute 0-1: Acknowledge & Assess
- [ ] Acknowledge the alert (stops escalation timers)
- [ ] Is this affecting users? Check your status page / error rate
- [ ] Severity level: SEV1 (down), SEV2 (degraded), SEV3 (minor)
Minute 1-2: Stakeholder Communication
- [ ] Post in your incident channel: "Investigating [alert name]"
- [ ] If SEV1: post public status page update
- [ ] Tag the right people (not everyone)
Minute 2-4: Investigation
- [ ] Check recent deployments (last 2 hours)
- [ ] Check infrastructure status (cloud provider, DNS, CDN)
- [ ] Check dependencies (database, API, third-party services)
- [ ] Reproduce the issue if possible
Minute 4-5: Decision Point
- [ ] Can you fix it in 10 minutes? → Fix and document
- [ ] Need more help? → Escalate with context
- [ ] Need a rollback? → Execute rollback procedure
- [ ] External dependency? → Open vendor ticket + communicate
Why This Works
The system works because it eliminates decision paralysis. When you're stressed and half-awake at 3am, you don't need to think — you need a checklist.
Every step has a clear action and a clear output. No ambiguity.
The Common Mistakes
- Alerting on everything — If everything is an alert, nothing is an alert. Tune your alerts.
- No runbooks — "We'll figure it out when it happens" is not a strategy.
- Over-communicating — Don't tag 20 people. Tag the 2-3 who can actually help.
- Under-communicating — Radio silence for 30 minutes is worse than "still investigating."
- No postmortem — If you don't learn from incidents, you'll repeat them.
Building Your Triage System
Start simple:
- Write the checklist above on a notecard
- Tape it to your monitor
- Use it for your next 5 incidents
- Adapt it to your specific stack
Then graduate to:
- Automated triage (webhook creates ticket with context)
- Pre-written communication templates
- Runbook library for your top 5 incident types
Get the complete system: The Ops Starter Kit ($14) includes the full triage checklist, communication templates, and 5 ready-to-use runbooks.
Want everything? The Ops Mega Bundle ($49) includes all 5 kits — starter, advanced, automation, field cards, and the incident quick-start guide.
Free download: The First 30 Minutes Checklist — the free lead magnet that started it all.
What's your incident triage process? Share your checklist below.
