Incident tabletop agenda
Run a tabletop that reveals real gaps.
Use this agenda for a 45–60 minute drill. It keeps the focus on decision quality, communication, and ownership.
A simple 5-part flow.
Keep the clock visible and assign roles up front.
| Time | Segment | Outcome |
|---|---|---|
| 0–5 min | Scenario brief + roles | Everyone aligned on context, severity, comms owner |
| 5–20 min | First checks + triage | Decide what to inspect and confirm impact |
| 20–35 min | Mitigations + verification | Choose safe actions and prove they worked |
| 35–45 min | Comms + escalation | Update cadence, who to pull in, customer impact |
| 45–60 min | Debrief + follow-ups | Capture gaps and assign owners immediately |
Assign roles, avoid chaos.
These roles keep the tabletop productive and realistic.
Incident commander
Owns the call, drives decision pace, and keeps the team aligned.
Comms lead
Runs the update cadence and keeps stakeholders informed.
Scribe
Captures decisions, follow-ups, and missing artifacts.
Copy/paste agenda template
Share in Slack or drop into a runbook.
Incident tabletop agenda (45–60 min)
Scenario:
Owners: IC / Comms / Scribe
0–5 min: Scenario brief + role assignment
5–20 min: First checks + impact confirmation
20–35 min: Safe mitigations + verification
35–45 min: Comms cadence + escalation
45–60 min: Debrief + follow-ups (owners + due dates)
Debrief prompts
- What slowed us down?
- Which runbook steps were missing or unclear?
- Which dashboards/logs did we wish we had?
- What ownership gaps appeared?
Use tabletops to harden runbooks.
Link drills to the runbooks and onboarding paths they should improve.
Turn on‑call knowledge into something your team can trust.
We map the workflows that create the most interrupts, then ship owned answers with source links and “first checks.” You get a plan you can run while shipping.
Owned answers
Every answer has an owner, source links, and first checks so engineers can verify fast.
Onboarding that scales
New hires self‑serve with the same answers your staff engineers trust.
Less escalation noise
Repeat pings drop because the “right answer” is owned and easy to find.