Incident command
A defined coordination role during incidents, in which one person owns coordination and communication so that responders can focus on the fix. During an incident the priorities are to restore service, communicate, and then diagnose.
Evidence grade: practice A widely adopted practitioner model with clear provenance.
Use it when
Any incident that is more than trivial. Decide the role before the incident, because during one is too late. At organisational scale, incidents that cross teams need a commander with authority across those teams.
Where it stops working
It is a coordination structure and offers no technical rescue. A commander who starts debugging has left the role.
Where the standard uses it
- DE-3Reliability, incident response, and operational ownershipOn-call, SLOs, postmortems, learning from failure.
Sources
- Betsy Beyer, Chris Jones, Jennifer Petoff and Niall Richard Murphy (editors). Site Reliability Engineering: How Google Runs Production Systems. O'Reilly Media, 2016. In the bibliography
Used alongside it
- Blameless postmortems practice
- DORA stability metrics research
- Service-level objectives and error budgets practice
Cite this model
Chicago, BibTeX and licence →Engineering Management Academy. (2026). Incident command. In Engineering Management Academy Body of Knowledge (Version 3.1, TEC.incident-command). https://www.engineeringmanagement.academy/body-of-knowledge/techniques/incident-command