Each status page update should answer four things: what customers see, who is affected, what you are doing and when the next update comes. Use four stages, investigating, identified, monitoring and resolved, and keep every post short, factual and free of guesses about cause.
Investigating
You know something is wrong, not why.
We are investigating elevated error rates when signing in. Some customers may see failed logins. We will post another update within 30 minutes.
Pick an update interval you can keep. Missing a promised update does more harm than a short post saying nothing has changed.
Identified
You know the cause well enough to act.
We have identified the cause as a faulty configuration change and are rolling it back. Sign in remains degraded for some customers. Next update in 30 minutes.
Say what the cause is only at the level you are sure of. "A configuration change" is fine. Naming a person, vendor or attacker before you have confirmed it is not.
Monitoring
A fix is applied and you are watching.
A fix has been applied and error rates are returning to normal. We are monitoring before closing this incident.
Resolved
This incident is resolved. Sign in was degraded between 14:05 and 14:52 UTC. A written summary will follow within five business days.
Use UTC, give start and end times, and commit to a follow up only if you will deliver it.
Phrases to avoid
- "A small number of users" unless you have counted.
- "No customer data was affected" during the incident. You usually cannot know yet. See the guide on checking such statements in what to ask when a vendor says no customer data was affected.
- Blame, hype or jokes.
- Hedging words that say nothing, such as "some issues".
Keep a template in the tool
Store these four templates inside your status page tool, so the on-call engineer edits a draft instead of staring at a blank box. Have a second person read every security related post before it goes out.
Quick check
How often should we update during a long incident?
Pick an interval, commonly 30 to 60 minutes, and post even when nothing changed.
Should the final summary be on the status page?
Link to it from the incident entry so everything about the event lives in one place.
Last reviewed: 19 October 2026.
