Skip to content

Template: Incident Acknowledgement

The first customer-facing message during a P0 / P1. Sent within 5 minutes of incident-channel acknowledge per ../oncall-runbook.md §2 step 1. Sets the expectation for the next update; does not speculate on cause.

Approval gate: P0 needs on-call-lead sign-off; P1 needs Tier 2 senior sign-off. See README.md §"Approval workflow".

Public version — status page

Post to the status page first; everything else mirrors this wording.

Title: Investigating — {IMPACTED_SERVICES}

We are currently investigating reports of issues affecting {IMPACTED_SERVICES}.

Detected at: {TIME_DETECTED}
Status: investigating
Next update by: {NEXT_UPDATE_BY}

No action is required from users. We will update this page as we learn more.

Conventions:

  • Title format is Investigating — <comma-separated list of impacted services>. Two services max in the title; spill the rest into the body.
  • "Reports of issues" is the safe wording when scope is still being confirmed. Once confirmed, the next update upgrades to "an outage affecting".
  • "No action is required" is correct only if there's nothing the user can do to mitigate. If a workaround exists (clear cache, retry in 10 min, use a different game), it goes into the next-update template — not the acknowledgement.

Public version — Twitter / social

P0 only. Single tweet, mirrors the status page lede; links to the status page for detail.

We are investigating reports of issues affecting {IMPACTED_SERVICES} on {CUSTOMER_NAME}. Status updates: {STATUS_PAGE_URL}

Don't quote tweet customer complaints. Don't reply individually until the resolved-template phase. The status page is the authoritative source.

Public version — customer email (SLA-bound customers only)

For P0 / P1 affecting a customer with a contractual SLA, send within 15 minutes of acknowledgement. Bcc internal alias.

Subject: [Incident {INCIDENT_ID}] {IMPACTED_SERVICES} — investigating

Hello,

We are writing to inform you of an active incident affecting {IMPACTED_SERVICES} on {CUSTOMER_NAME}, detected at {TIME_DETECTED}.

Current status: investigating
Next update by: {NEXT_UPDATE_BY}
Status page: {STATUS_PAGE_URL}

We will continue to update you at the cadence specified in your support agreement. If you have questions in the meantime, please reply to this email or contact {SUPPORT_EMAIL}.

Regards,
{CUSTOMER_NAME} Operations

Internal version — Slack #oncall

The IC posts this in the incident channel root. Keeps the channel topic clean; play-by-play continues in a thread off this post.

:rotating_light: P{SEVERITY} acknowledged — {IMPACTED_SERVICES}

INC: {INCIDENT_ID}
Detected: {TIME_DETECTED}
IC: {IC_NAME}
Suspected scope: {IMPACTED_SERVICES}
Status page: posted ({STATUS_PAGE_URL})
Next update: {NEXT_UPDATE_BY}

Bridge: {VIDEO_BRIDGE_URL}
Investigation thread :point_down:

Pin this message to the channel topic. Update the topic again at every status-page update.

Internal version — PagerDuty incident comms

Auto-mirrors from the status-page post if PagerDuty's status-page integration is wired ({{TBD: confirm integration is configured for the customer team's status page provider}}). If not, paste the public version into the incident's "Notes" tab.

Variables to fill

Variable Source Example
{INCIDENT_ID} Internal incident-tracker ID INC-2026-0042
{SEVERITY} Per ../oncall-runbook.md §1 0, 1
{TIME_DETECTED} First symptom observed (ISO 8601 UTC) 2026-04-25T14:32:00Z
{IMPACTED_SERVICES} Customer-language list, ≤ 3 items dropbet sign-in, bet placement
{NEXT_UPDATE_BY} ISO 8601 UTC; +30 min for P0, +60 min for P1 2026-04-25T15:02:00Z
{IC_NAME} Incident commander Alex Rivera
{CUSTOMER_NAME} Operator / partner brand dropbet
{STATUS_PAGE_URL} Public status page {{TBD: customer-team-owned URL}}
{SUPPORT_EMAIL} Tier 1 / SLA support inbox {{TBD: e.g., support@customer.example}}
{VIDEO_BRIDGE_URL} Spun up at acknowledge {{TBD: zoom/meet/teams URL}}

Don'ts

  • Don't name a root cause. "Investigating" is the only acceptable status here.
  • Don't promise a resolution time. Promise a next-update time; resolution comes later.
  • Don't include trace IDs, span IDs, internal service names, or any link to internal dashboards in the public message. Save those for the internal version.
  • Don't apologize disproportionately. One factual line per audience is enough — see README.md §Tone.

Cross-references