Critical systems
A whole region goes dark
A regional dependency disrupts a customer-facing service. Coordinate continuity, uncertain recovery times and stakeholder updates.
20 minutes suggested · Four incident updates · One shared screen
Start this rehearsal →Watch the quick field guide
24-second visual guide · captions and transcript · no autoplay
Read the guidance transcript
Name what is affected. Read the fictional alert. Identify the business impact and what is still unknown; avoid jumping to a diagnosis.
Pick the next move. Compare recovery and communication options. Each choice changes the exercise narrative, not a real system.
Keep the room aligned. Use the timeline and decision log to agree one coordinator, one update and the next checkpoint.
Close the loop. Capture recovery assumptions and assign follow-up actions. Export the report so the learning outlives the meeting.
Who should be in the room?
Facilitator, Incident commander, SRE lead, Customer communications. These are discussion roles, not account invitations. One person records while the team talks.
What the team will practice
Customers report a regional pattern
The boundary and upstream dependencies need verification.
Discussion: How will you establish scope without treating every symptom as the same outage?
Failover has a dependency
An untested dependency can turn a quick failover into a broader incident.
Discussion: Which checks and decision owner should determine whether to fail over?
The status page needs an update
The team needs a useful update without inventing certainty.
Discussion: What can you say now, who approves it and when will you update again?
Traffic begins to recover
Recovery should reflect user experience and dependencies, not a single metric.
Discussion: What evidence closes the incident and what resilience action gets an owner?
What you’ll leave with
Your own recorded decisions, uncertainties and improvement actions with owners, dates and status. Print a readable report or export a browser-local session to revisit.
Original fictional content, not a technical response procedure. No real systems are changed. This exercise does not certify security readiness or compliance.
Read the facilitator guide →