Outage Post-Mortem and Client Disclosure (Handoff)

Outage Post-Mortem and Client Disclosure (Handoff)

1. 01

   Freeze the incident timeline within 24 hours of resolution

   Pull timestamps from the status feed, your paging log, and the client ticket queue into one chronological record before memory decays. Note the first vendor signal, the first internal detection, and the moment the client noticed, since the gap between those three numbers is the number the retainer conversation will turn on.

2. 02

   Separate upstream cause from internal amplification

   A vendor status page going yellow rarely explains a broken deliverable on its own. Document which of your own dependencies (retry logic, missing fallback, single-region hosting) turned a third-party degradation into client-visible failure, and label each one as vendor-controlled or agency-controlled.

3. 03

   Quantify client impact in deliverable terms, not uptime terms

   Convert the outage window into missed sends, delayed reports, stale dashboards, or breached response times. A 40-minute API failure means nothing to a client; three unsent campaign batches and a late Monday report means everything.

4. 04

   Draft the disclosure note before the client asks

   Lead with what broke, then what you did, then what changes. Keep it under 200 words and avoid vendor blame as the headline. Agencies that disclose first set the tone of the conversation; agencies that respond to a client complaint inherit it.

5. 05

   Attach one concrete control change with an owner and a date

   Every post-mortem should ship at least one verifiable fix: a secondary status source, a queue-depth alert threshold, a documented manual fallback. Name the person and the week it lands, then confirm it in the next monthly review.

6. 06

   Route the finding into the shared dependency register

   Log the vendor, the failure mode, and the detection lag alongside your other monitored services so the next occurrence is recognized faster. Recurring offenders belong in a named risk section of the client's quarterly review, not buried in a ticket.

7. 07

   Review the alert volume that fired during the window

   Count pages sent versus pages that required action. If the incident produced more than a handful of redundant alerts, prune or deduplicate the rule set before the next cycle, because a noisy incident teaches the on-call team to skim.