Data Incident Triage Form & Communication Playbook

{ "Title": "Data Incident Triage & Communication Playbook", "IntroductionHtml": "

Purpose

This interactive triage form helps teams quickly capture the essential facts, assign ownership, coordinate containment, and notify the right people when a data, analytics, or model incident occurs. Use it to shorten time-to-detection and recovery, preserve important triage data, and make post-incident analysis easier.

How to use

1. Fill the fields you know now — partial entries are OK.
2. Assign an initial owner and take immediate containment actions.
3. Use the communication templates below to notify stakeholders rapidly.
4. Save the triage; use the stored record to drive RCA and follow-up tasks.

Communication templates (quick copy)

Engineering / Response Team

Subject: [Incident] {incident_id || ID} — {classification} affecting {impacted_metrics}

Summary: Detected at {detection_time}. Impact: {scope} — impacted metrics: {impacted_metrics}.

Initial owner: {initial_owner} ({owner_team}). Immediate containment: {containment_actions}

Requested action: Triage, contain, and restore. Updates every 30 min or on status change.

Business / Product Stakeholders

Subject: Data incident affecting {impacted_metrics}

Summary: We detected an issue at {detection_time} that may affect reporting and decisions based on {impacted_metrics}. Engineering is investigating. Impacted scope: {scope}.

Owner: {initial_owner}. Expected update: in 60 minutes or sooner.

Executive

Subject: Incident alert — {classification} impacting {impacted_metrics}

One-sentence summary of impact, affected customers/teams, and current mitigation plan. Owner: {initial_owner}.

", "SubmitLabel": "Save Triage", "SuccessMessage": "Triage saved. Use this record to coordinate ongoing response, create a tracking ticket if needed, and populate the post-incident RCA. Consider notifying stakeholders with the appropriate template and assigning follow-up actions.", "DataType": "data-incident-triage", "SchemaVersion": "1.0", "Fields": [ {"Key": "incident_id", "Type": "text", "Label": "Incident ID / Short Title", "HelpText": "A short unique identifier (use existing ticket ID if available).", "Required": true}, {"Key": "detection_time", "Type": "text", "Label": "Detection time (local)", "HelpText": "When the problem was first noticed or alarm triggered. ISO timestamp or human-readable time.", "Required": true}, {"Key": "reporter_name", "Type": "text", "Label": "Reporter name", "HelpText": "Who detected/reported the issue."}, {"Key": "reporter_contact", "Type": "text", "Label": "Reporter contact (email/Slack)", "HelpText": "Best way to reach the reporter for follow-up."}, {"Key": "detection_method", "Type": "select", "Label": "How was this detected?", "HelpText": "Choose the primary detection channel.", "Required": true, "Options": [ {"Value": "monitoring_alert", "Label": "Monitoring alert"}, {"Value": "user_report", "Label": "User / stakeholder report"}, {"Value": "downstream_alert", "Label": "Downstream/consumer alert"}, {"Value": "scheduled_check", "Label": "Scheduled job / health check"}, {"Value": "other", "Label": "Other"} ]}, {"Key": "impacted_metrics", "Type": "textarea", "Label": "Impacted metrics, reports, or models", "HelpText": "List affected dashboards, KPIs, tables, or models. Be specific (table.column or dashboard name).", "Required": true}, {"Key": "scope", "Type": "radio", "Label": "Scope / where the problem appears", "HelpText": "Choose the best single option that describes where the issue is visible.", "Options": [ {"Value": "data_pipeline", "Label": "Data pipeline / ETL"}, {"Value": "data_quality", "Label": "Data quality / content"}, {"Value": "model", "Label": "Model predictions / drift"}, {"Value": "dashboard", "Label": "Dashboard / reports"}, {"Value": "external_system", "Label": "External system / upstream"}, {"Value": "other", "Label": "Other"} ], "Required": true}, {"Key": "estimated_start_time", "Type": "text", "Label": "Estimated incident start time", "HelpText": "If different from detection time, when the problem likely began."}, {"Key": "severity", "Type": "select", "Label": "Initial severity", "HelpText": "Use severity to prioritize resources. Update if it changes.", "Options": [ {"Value": "sev1", "Label": "Sev 1 — Critical: major outage affecting many users or core business decisions"}, {"Value": "sev2", "Label": "Sev 2 — High: significant impact but partial workarounds exist"}, {"Value": "sev3", "Label": "Sev 3 — Moderate: limited impact, localized or minor degradation"}, {"Value": "sev4", "Label": "Sev 4 — Low: informational or cosmetic issue"} ], "Required": true}, {"Key": "classification", "Type": "select", "Label": "Probable classification", "HelpText": "Best current guess of root cause category.", "Options": [ {"Value": "pipeline_failure", "Label": "Pipeline failure / job error"}, {"Value": "schema_change", "Label": "Schema or contract change"}, {"Value": "data_quality", "Label": "Data quality (invalid, missing, stale)"}, {"Value": "infrastructure", "Label": "Infrastructure / hosting / permissions"}, {"Value": "model_drift", "Label": "Model performance / drift"}, {"Value": "configuration", "Label": "Config / deployment issue"}, {"Value": "security", "Label": "Security incident"}, {"Value": "other", "Label": "Other / unknown"} ], "Required": true}, {"Key": "initial_owner", "Type": "text", "Label": "Initial owner (person)", "HelpText": "Who will lead the immediate response? Make someone accountable.", "Required": true}, {"Key": "owner_team", "Type": "select", "Label": "Owner team", "HelpText": "Team responsible for response.", "Options": [ {"Value": "data_engineering", "Label": "Data Engineering"}, {"Value": "ml_platform", "Label": "ML / Model Ops"}, {"Value": "analytics", "Label": "Analytics / BI"}, {"Value": "sre", "Label": "SRE / Infra"}, {"Value": "security", "Label": "Security"}, {"Value": "product", "Label": "Product / Data Product"}, {"Value": "other", "Label": "Other"} ]}, {"Key": "containment_actions", "Type": "textarea", "Label": "Immediate containment actions taken", "HelpText": "What was done already to limit impact (rollback, stop pipeline, revert model, switch to fallback data).", "Required": true}, {"Key": "immediate_next_steps", "Type": "textarea", "Label": "Immediate next steps", "HelpText": "Short, time-boxed next actions (e.g., run data backfill, escalate to SRE, open ticket)."}, {"Key": "stakeholders", "Type": "checkbox", "Label": "Stakeholders to notify now", "HelpText": "Select who should be informed immediately.", "Options": [ {"Value": "engineering_team", "Label": "Engineering / Responders"}, {"Value": "data_product_owner", "Label": "Data product owner / manager"}, {"Value": "business_stakeholders", "Label": "Business / Reporting consumers"}, {"Value": "executives", "Label": "Executives"}, {"Value": "customers", "Label": "Customers / External partners"} ]}, {"Key": "communication_template_choice", "Type": "select", "Label": "Preferred communication template", "HelpText": "Choose a template to copy into your notification channel.", "Options": [ {"Value": "engineering", "Label": "Engineering / Response"}, {"Value": "business", "Label": "Business / Product"}, {"Value": "executive", "Label": "Executive"} ]}, {"Key": "communication_notes", "Type": "textarea", "Label": "Communication notes / channel", "HelpText": "Where and how you notified stakeholders (Slack #channel, email, incident page)."}, {"Key": "create_tracking_ticket", "Type": "yesno", "Label": "Create a tracking ticket now?", "HelpText": "If yes, create a ticket that links to this triage record and assign owner."}, {"Key": "rca_required", "Type": "yesno", "Label": "Will an RCA be required?", "HelpText": "Decide now whether a full RCA and action plan are needed."}, {"Key": "rca_owner", "Type": "text", "Label": "RCA owner", "HelpText": "Person responsible for the post-incident RCA."}, {"Key": "rca_due_date", "Type": "text", "Label": "RCA due date", "HelpText": "Target date for RCA completion."}, {"Key": "rca_summary", "Type": "textarea", "Label": "RCA summary (post-incident)", "HelpText": "After the incident, summarize root cause, corrective actions, and lessons learned."} ] }