Multi-Team Incident Coordination

Some incidents span teams. The coordination pattern that prevents finger-pointing.

Single IC

Multi-team incidents need one decision authority across the involved teams. Per-team tech leads execute within their domain; the IC owns the global picture and the cross-team decisions. Dual-IC ambiguity costs MTTR every time it appears.

• Single IC across teams. Named global commander per incident. Even when multiple teams are involved.
• Per-team tech lead. Named lead per team reporting to the IC. The IC aggregates; leads execute.
• Explicit IC declaration. Visible “I am IC” message per incident. Catches dual-IC confusion early.
• IC bench depth. Per-rotation the IC pool deep enough for multi-team scope. Supports continuity through long incidents.

Framing

Multi-team incidents are tempting to frame as “whose fault” questions. The IC enforces system-first framing across team boundaries: our combined systems caused this, not their team broke ours.

• Combined-systems framing. “Our two systems combined to cause this.” Not whose fault.
• IC enforces the framing. Active reset when finger-pointing starts. Without enforcement, blameless culture erodes at team boundaries.
• Named blameless rule. Visible language guide per incident. New responders learn the norm by reading.
• Own-contribution-first norm. Each team lead surfaces their own contributing factors first. Disarms defensiveness across the boundary.

Close

Closing a multi-team incident is joint. Joint postmortem, both teams’ contributing factors documented, shared action items where remediation requires both teams. Diffuse ownership is the recurring failure mode; named accountable leads prevent it.

• Joint postmortem. Both teams write it together per incident. Contributing factors from both sides documented.
• Shared action items. Joint ownership where remediation requires both. The most failure-prone action-item type without explicit accountability.
• Named lead per shared action. Single accountable lead per shared item. Diffuse ownership caught.
• Published cross-team summary. Visible-to-both-teams write-up per incident. Learning crosses the boundary.