<metaproperty="og:title"content="Call Etiquette - Spearhead Systems Incident Response Documentation"/>
<metaproperty="og:site_name"content="Spearhead Systems Incident Response Documentation"/>
<metaproperty="og:description"content="A collection of information about the Spearhead Systems incident response process. Not only how to prepare new employees for on-call responsibilities, but also how to handle major incidents, both in preparation and after-work."/>
<metaname="twitter:title"content="Call Etiquette - Spearhead Systems Incident Response Documentation"/>
<metaname="twitter:description"content="A collection of information about the Spearhead Systems incident response process. Not only how to prepare new employees for on-call responsibilities, but also how to handle major incidents, both in preparation and after-work."/>
<p>You've just joined an incident call, and you've never been on one before. You have no idea what's going on, or what you're supposed to be doing. This page will help you through your first time on an incident call, and will provide a reference for future calls you may be a part of.</p>
<em>Credit: <ahref="https://commons.wikimedia.org/wiki/File:Barack_Obama_on_phone_with_Benjamin_Netanyahu_2009-06-08.jpg">Official White House Photo</a> by Pete Souza</em></p>
<p><strong>Use clear terminology, and avoid using acronyms or abbreviations during a call. Clear and accurate communication is more important than quick communication.</strong></p>
<p>Standard radio <ahref="https://en.wikipedia.org/wiki/Voice_procedure#Words_in_voice_procedure">voice procedure</a> does not need to be followed on calls. However, you should familiarize yourself with the terms, as you may hear them on a call (or need to use them yourself). The ones in more active use on major incident calls are,</p>
<ul>
<li><strong>Ack/Rog</strong> - "I have received and understood"</li>
<li><strong>Say Again</strong> - "Repeat your last message"</li>
<li><strong>Standby</strong> - "Please wait a moment for the next response"</li>
<li><strong>Wilco</strong> - "Will comply"</li>
</ul>
<p>Do not invent new abbreviations, and always favor being explicit of implicit. It is better to make things clearer than to try and save time by abbreviating, only to have a misunderstanding because others didn't know the abbreviation.</p>
<p>The Incident Commander (IC) is the leader of the incident response process, and is responsible for bringing the incident to resolution. They will announce themselves at the start of the call, and will generally be doing most of the talking.</p>
<ul>
<li>Follow all instructions from the incident commander, without exception.</li>
<li>Do not perform any actions unless the incident commander has told you to do so.</li>
<li>The commander will typically poll for any strong objections before performing a large action. This is your time to raise any objections if you have them.</li>
<li>Once the commander has made a decision, that decision is final and should be followed, even if you disagreed during the poll.</li>
<li>Answer any questions the commander asks you in a clear and concise way.<ul>
<li>Answering that you "don't know" something is perfectly acceptable. Do not try to guess.</li>
</ul>
</li>
<li>The commander may ask you to investigate something and get back to them in X minutes. Make sure you are ready with an answer within that time.<ul>
<li>Answering that you need more time is perfectly acceptable, but you need to give the commander an estimate of how much time.</li>
<h4id="theres-no-incident-commander-on-the-call-i-dont-know-what-to-do">There's no incident commander on the call! I don't know what to do!<aclass="headerlink"href="#theres-no-incident-commander-on-the-call-i-dont-know-what-to-do"title="Permanent link">#</a></h4>
<p>Ask on the call if an IC is present. If you have no response, type <code>!ic page</code> in Slack. This will page the primary and backup IC to the call.</p>
<h4id="i-can-join-the-call-or-slack-but-not-both-what-should-i-do">I can join the call or Slack, but not both, what should I do?<aclass="headerlink"href="#i-can-join-the-call-or-slack-but-not-both-what-should-i-do"title="Permanent link">#</a></h4>
<p>You're welcome to join only one of the channels, however you should not actively participate in the incident response if so, as it causes disjoined communication. Liaise with someone who is both in Slack and on the call to provide any input you may have so that they can raise it.</p>
