Incident Response 101 for Small Teams

What this guide covers

Before you have an on-call rotation or an SRE team, you still need a way to handle outages that does not depend on who happens to be awake. This guide covers the minimum viable incident process for a small team: the four pieces you need, why each matters, and how to grow the process only when the simple version starts to strain.

• One channel and one owner is enough to start.
• Decide the customer communication path before you need it.
• Add process only after the simple version proves itself.

The four things you actually need

A workable incident process for a small team has exactly four parts. Everything else is an optimization you add later.

• One alert channel — every production alert lands in the same place, so nothing is missed.
• One owner per incident — a single person drives it to resolution, even if others help.
• One customer communication path — a status page or a known place to post updates.
• One review habit — a quick look back after anything non-trivial, capturing one or two follow-ups.

When to add more process

Let pain, not aspiration, drive process. Add an on-call rotation when "whoever notices" stops being reliable — usually when alerts arrive outside working hours often enough to matter. Add severity levels when you find yourself over-reacting to minor issues or under-reacting to major ones. Add a communications role when the person fixing the problem cannot also keep customers updated. Each addition should solve a problem you have actually felt.

How Sandglass supports the practice

Point all production alerts at one place — a Slack channel or a webhook into your tooling — using Sandglass alert routing, and back your status page with checks so customer communication has a home. When an alert fires, one person owns it until it is resolved. That is enough to run your first hundred incidents.

• Back the practices here with HTTP, ping, TCP, content, SSL certificate, and heartbeat checks.
• Route incidents to email, Slack webhook channels, and generic webhooks so the right people respond fast.
• Use a public status page to keep customers informed while the team works the incident.

Common mistakes to avoid

Borrowing enterprise process too early creates ceremony without benefit. A five-person team does not need severity matrices with eight levels, a dedicated incident commander role, and a three-stage approval for status updates. It needs clarity and speed. Copying a big company's runbook usually slows you down.