WORKED EXAMPLE · MANAGED SERVICES
An incident path with a named owner
Alerts, on call, patching, restores and changes given a named owner and a written runbook for a platform its builders have left.
THE SITUATION
The company shape
A company runs a customer-facing platform built by an agency that has since moved on. Alerts arrive in a shared inbox that several people read and nobody owns.
Backups run every night and nobody has restored one. Patching happens when someone remembers, and changes reach production without a record of who decided them.
DISCOVERY
Weeks 1 to 2
We would write the service map: systems, service hours, dependencies and the business decision owner for each.
We would read the current alerts and recent incident notes and separate the signals that need a person from the ones that cannot drive any action.
We would trace the incident path as it works today: who is alerted, who can act, who decides, and where it stops.
We would plan a restore test for the most important data store.
BUILD
Weeks 3 to 6
We would set the alert baseline and an on call rota with named recipients instead of the shared inbox.
The incident path would be written per severity, with the authority to act agreed in advance.
We would run the restore test, record the result and fix what it exposed, then set a patch schedule.
Changes would get a workflow with a reason, a reviewer and a rollback decision, and we would run the incident path once outside working hours before handover.
AT THE END
What the client would hold
Monitoring and on call
A monitoring baseline, on call rota and incident response runbook.
Patching and backups
A patch schedule, tested backup configuration and restore runbook.
Change management
A change workflow, release record template and rollback runbook.
LIMITS
What we would have said no to
On call before the path exists
Taking the pager before the incident path is written would only move the confusion to us.
Cover without authority
We would not accept round the clock cover without the access and the authority to act on what we see.
Alerts kept just in case
An alert nobody acts on trains people to ignore the ones that matter. It goes, or it gets an owner and an action.
Operating without written access
Production access is agreed in writing before the first shift.
Bring your own situation
Describe what you run and where it hurts. We reply with how the first two weeks of managed services work would look for you.