# Write internal status updates during a live production incident

Drafts clear, regular updates for engineers, leadership, and support while an outage is still happening, without guessing at causes or ETAs.

- Topic: Email & Workplace Communication
- Framework: Few-Shot
- Level: Advanced
- Tags: Write, Fill-in Template
- Source: https://www.thinkwithprompt.com/prompts/write-internal-status-updates-during-a-live-production-incident

## Prompt

```text
Help me write internal status updates for a production incident that's happening right now.

**What's broken (user impact):** [e.g. "20% of logins failing in EU", "dashboards loading slowly"]
**Started at:** [TIME AND TIME ZONE]
**What we know so far:** [SYMPTOMS, SUSPECTED CAUSE, RECENT DEPLOYS OR CHANGES]
**What we're doing:** [CURRENT ACTIONS, e.g. "rolling back", "scaling the database"]
**Severity level:** [e.g. "SEV1", "SEV2"]
**Roles:** [INCIDENT LEAD, COMMS OWNER, WHO IS INVESTIGATING WHAT]

Write one update per internal audience:
- **Incident channel (engineers):** current hypothesis and evidence, what has been ruled out, who is doing what, what help or access is needed, and changes that must be paused (deploys, migrations).
- **Leadership:** impact in business terms (users, customers, revenue affected - use [CONFIRM] where I haven't given numbers), current status, decisions they may need to make, and next update time. No jargon.
- **Support team:** what customers will notice, approved wording to use, known workarounds, and what not to promise (causes, ETAs, credits).

Rules for all updates:
- Lead with impact and current status, in the first line.
- Separate what we know from what we suspect. Never state a root cause that isn't confirmed.
- Never give a fix ETA we can't stand behind; give the time of the next update instead.
- Use UTC or one stated time zone throughout.
- End each update with "Next update by [TIME]".

Also give me:
1. A fill-in template I can reuse every 30 minutes as the incident evolves.
2. A "mitigated, monitoring" update and a "resolved" update for each audience, including what follow-up (postmortem, customer comms) happens next.
3. A short timeline log format to keep during the incident so the postmortem is easy to write later.
```

## What to fill in

- TIME AND TIME ZONE
- SYMPTOMS, SUSPECTED CAUSE, RECENT DEPLOYS OR CHANGES
- CURRENT ACTIONS, e.g. "rolling back", "scaling the database"
- e.g. "SEV1", "SEV2"
- INCIDENT LEAD, COMMS OWNER, WHO IS INVESTIGATING WHAT
- CONFIRM
- TIME

Free to copy and use. From ThinkWithPrompt (https://www.thinkwithprompt.com/), a library of 2,663 curated AI prompts.