# Call Etiquette - Spearhead Systems Incident Response Documentation
A collection of information about the Spearhead Systems incident response process. Not only how to prepare new employees for on-call responsibilities, but also how to handle major incidents, both in preparation and after-work.
Author: Spearhead Systems, Inc.
Keywords: spearhead, incident, response

# Call Etiquette

You've just joined Spearhead Systems support staff and you've never worked in a service delivery function before. You have no idea what an incident or a service request is. You have no idea what's going on, or what you're supposed to be doing. This page will help you through your first time and will provide a reference for future issues you may be a part of.

Credit: Official White House Photo by Pete Souza

## First Steps

- If you intend on participating on the incident call you should join both the call, review the associated cards in DoIT, and jump on the corresponding Slack channel.
- Make sure you are in a quiet environment in order to participate on the call. Background noise should be kept to a minimum.
- Keep your microphone muted until you have something to say.
- Identify yourself when you join the call; State your name and the system you are the expert for.
- Speak up and speak clearly.
- Be direct and factual.
- Keep conversations/discussions short and to the point.
- Bring any concerns to the Team Leader (IC) on the call.
- Respect time constraints given by the Team Leader.

Incident Call

Not all issues start with an incident call. Some issues may be completely automated and available only in DoIT while others may be in the incipient stages and the customer may still be on the phone/Slack detailing their issue.

## Lingo

Use clear terminology, and avoid using acronyms or abbreviations during a call. Clear and accurate communication is more important than quick communication.

Standard radio voice procedure does not need to be followed on calls. However, you should familiarize yourself with the terms, as you may hear them on a call (or need to use them yourself). The ones in more active use on major incident calls are,

- Ack/Rog - "I have received and understood"
- Say Again - "Repeat your last message"
- Standby - "Please wait a moment for the next response"
- Wilco - "Will comply"

Do not invent new abbreviations, and always favor being explicit of implicit. It is better to make things clearer than to try and save time by abbreviating, only to have a misunderstanding because others didn't know the abbreviation.

## The Team Leader

The Team Leader (TL) is the leader of the incident response process, and is responsible for bringing the incident to resolution. They will announce themselves at the start of the call, and will generally be doing most of the talking.

- Follow all instructions from the team leader, without exception.
- Do not perform any actions unless the team leader has told you to do so.
- The team leader will typically poll for any strong objections before performing a large action. This is your time to raise any objections if you have them.
- Once the team leader has made a decision, that decision is final and should be followed, even if you disagreed during the poll.
- Answer any questions the team leader asks you in a clear and concise way.
  - Answering that you "don't know" something is perfectly acceptable. Do not try to guess.
- The team leader may ask you to investigate something and get back to them in X minutes. Make sure you are ready with an answer within that time.
  - Answering that you need more time is perfectly acceptable, but you need to give the team leader an estimate of how much time.

## Problems?

#### There's no team leader on the call! I don't know what to do!

Ask on the call if an TL is present. If you have no response, try asking in Slack. If there is no TL the sysadmin can take over this role temporarily.

#### There is not enough information!

The definitive source of information for all issues is in DoIT. If at any point there is a discrepancy ask the TL or Sysadmins to provide up to date information and update the card/tasks accordingly. At a minimum information should be available in Slack.

#### I can join the call or Slack, but not both, what should I do?

You're welcome to join only one of the channels, however you should not actively participate in the incident response if so, as it causes disjoined communication. Liaise with someone who is both in Slack and on the call to provide any input you may have so that they can raise it.

Copyright © Spearhead Systems, Inc. – Documentation built with MkDocs using the Material theme.