Declare early. Google's incident guidance says to declare if you need a second team, if customers can see the problem, or if it is unsolved after an hour of concentrated analysis. It is easier to close a small incident than to build structure hours into a growing one.
The three triggers
From the SRE incident chapter:
- You need to involve a second team to fix the problem.
- The outage is visible to customers.
- The issue is still unsolved after an hour's concentrated analysis.
Translate each for security work.
- Second team. A suspected credential leak needs identity, engineering and legal. The moment you need them, declare.
- Customer visible. Suspected exposure of customer data, even if unconfirmed.
- An hour without progress. Strange traffic you cannot explain.
Why early beats late
Declaring starts the machinery: a commander, a document, a comms lead. Without it, three people do three different things with no shared view. Responders also get tired sooner when unstructured.
Why people hesitate
- Fear of crying wolf
- Fear of being blamed if it was nothing
- Not wanting to wake others
A blameless culture is the antidote. If a declared incident turns out to be minor, close it with a short note and thank the person who raised it.
Make it cheap
- A single command or form to declare.
- A template for the living incident document.
- Pre-agreed severity levels so no one debates labels.
- A simple rule that anyone on the team may declare.
Define your own triggers
The postmortem chapter says review triggers should be defined before incidents happen. Do the same for declaration. Write four to six criteria in your own terms and review them after real events.
What to do in the first ten minutes
- Name a commander.
- Open the incident document.
- State what is known, what is not, and the next action.
- Assign roles for operations and communication.
Severity levels in plain words
Keep severity levels short and in everyday language. For example: low means one team can handle it in working hours, medium means more than one team is involved, high means customer data or service is affected. Your own definitions will differ, so write them with your team.
The point is that the lowest level exists and is cheap. If the only available option is a major incident, people will avoid declaring anything. A light, low severity process encourages early declaration, which is exactly what you want.
Quick check
What if the incident turns out to be a false alarm?
Close it, record what triggered it, and note any alert tuning that results. That is a successful outcome, not a failure.
Sources
Last reviewed: 19 October 2026.
