Incident management training is a practical program that prepares technical teams to respond to service outages in a coordinated way. It covers severity triage, the first 15 minutes, incident commander and supporting roles, status updates for customers and executives, working calmly under pressure, handovers across time zones, sustainable on-call rotas and blameless post-incident reviews.
- Recommended: 2 days in person, or 4 × 3.5-hour live virtual sessions, plus a 90-day practice drill cycle
- Level: Intermediate · In person · Live virtual · Blended
- Designed with the ADDIE model and customised to your context
- Offered by Bodhih since 2008 to 2,000+ organisations across 7 regions
Also known as: incident response training for IT teams, major incident management workshop, on-call training for engineers, incident commander training
Where and how: incident management training as an in-person workshop in Bengaluru, Mumbai, Delhi NCR, Gurugram, Hyderabad, Chennai, Pune, Kolkata, Ahmedabad and Jaipur; as a live online course; or delivered overseas in Dubai, Singapore and across the Middle East, Asia and Africa.
Last reviewed by Siddharthan VGJ, Founder · Bodhih Training, Bengaluru
Why outages are now a people problem as much as a technical one
Services now depend on chains of cloud components, third-party integrations and teams spread across Chennai, Bengaluru and overseas offices. When something breaks, the hardest part is often not the fix but the coordination: who decides, who talks to customers and who keeps notes.
Teams that rehearse roles and updates recover faster and argue less. Incident management training turns tribal knowledge into a shared routine, so a new engineer on the night shift knows exactly what to do in the first fifteen minutes.
India has over 1,700 global capability centres employing more than 19 lakh people.
What participants will be able to do
Triage severity fast
Classify an incident by customer impact and urgency within minutes, using a shared severity scale.
Own the first 15 minutes
Declare the incident, open a channel, assign roles and send the first update before diving into the fix.
Run clear incident roles
Act as incident commander, communications lead or scribe, and keep responders focused on one plan.
Write updates people trust
Send short, regular status updates for customers and executives that say what is known, what is not and when the next update comes.
Hand over across time zones
Pass a live incident to another shift or region with a handover note that loses no context.
Learn without blame
Run a blameless post-incident review that finds contributing causes and ends in owned, dated fixes.
Who should attend
- Site reliability, DevOps and platform engineers who join on-call rotas
- NOC and command centre teams monitoring services round the clock
- Application support and service desk engineers handling major incidents
- Engineering and operations leads who act as incident commanders
- GCC teams supporting global services across several time zones
- Customer support leads who own communication during outages
Program outline
Recommended design, customised to your context after a short needs analysis.
01Severity and triageModule 1 · 90 min+
- Building a severity scale around customer impact
- Deciding quickly with incomplete information
- When to declare and when to escalate
02The first 15 minutesModule 2 · 90 min+
- Declare, gather, assign, update
- Stopping the 'everyone debugging at once' pattern
- Stabilise first, find the cause later
03Incident rolesModule 3 · 2 hours+
- Incident commander, technical lead, communications lead and scribe
- Running a focused incident call
- Swapping the commander role safely during a long incident
04Status updates for customers and executivesModule 4 · 90 min+
- Known, unknown, next step, next update time
- Different updates for customers, executives and engineers
- Avoiding guesses and false all-clears
05Calm under pressure and handoversModule 5 · 90 min+
- Simple routines that keep thinking clear
- Handover notes across shifts and regions
- Sustainable on-call rotas and recovery time
06Blameless post-incident reviewsModule 6 · 2 hours+
- Building a timeline from notes and logs
- Contributing causes rather than a single culprit
- Fixes with owners, dates and follow-through
Sample training plan: 2-day hands-on design
This two-day design lets teams live through outages before the real ones arrive. Day 1 builds a shared severity scale, drills the first 15 minutes and rotates everyone through commander, communications and scribe roles in timed simulations. Day 2 covers status updates, staying calm under pressure, handovers across time zones and on-call rotas. The capstone is a long incident that crosses a shift change, followed by a blameless review. Teams leave with a severity scale, playbook and drill calendar.
Participants can triage severity, run the opening minutes of an incident and work in clear incident roles.
- 09:30–10:00Everyone on the callEnergiser
- 10:00–11:00Our severity scaleBuild sprint
- 11:15–12:30The first 15 minutesSkill drill
- 13:15–14:45Roles in actionSimulation
- 15:00–16:15Swapping the commanderRole-play
- 16:15–17:30Our incident playbookBuild sprint
Participants can communicate during incidents, hand over across time zones and run a blameless review.
- 09:30–10:30Updates people trustSkill drill
- 10:45–11:45Calm under pressurePeer coaching
- 11:45–12:45Across the time zonesCase clinic
- 13:30–15:00Capstone: the long nightSimulation
- 15:15–16:30Blameless reviewCase clinic
- 16:30–17:30Our 90-day drill planAction planning
Every session’s activity, timings, outputs and materials, plus pre-work, a 90-day reinforcement plan and how impact is measured. Free, emailed to you instantly.
Recommended: 2 days in person (09:30–17:30 each day), or 4 × 3.5-hour live virtual sessions, plus a 90-day cycle of monthly game-day drills. A sample design: every Bodhih program is customised after a short needs analysis.
How long is incident management training?
The recommended design is two full days in person or four live virtual sessions of three and a half hours, followed by a 90-day cycle of monthly game-day drills and lead check-ins.
What activities are included in incident management training?
Teams build a severity scale, drill the first 15 minutes against a timer, rotate through incident roles in live outage simulations, write updates for three audiences, practise commander and shift handovers, run a long-night capstone and lead a blameless review.
How we deliver it
Live outage simulations
Teams respond to scripted incidents that unfold in real time, with alerts, confused customers and executives asking for updates.
Role rotation
Everyone takes a turn as commander, communications lead and scribe, so the whole team understands each seat.
Tool-neutral practice
Exercises work with whatever monitoring, chat and ticketing tools your team uses, because the skills are about coordination.
Drill cycle
After the program, teams run a short game-day drill each month, building the routine into normal operations.
Tailored versions
For GCC and follow-the-sun teams
Adds cross-region handovers, updates for headquarters stakeholders and shared roles when India and overseas teams respond together.
For NOC and service desk teams
Focuses on triage at the front door, escalation paths, customer call scripts during outages and tracking many tickets linked to one incident.
For engineering leaders
A half-day module on sponsoring incident practice, reading post-incident reviews and building on-call rotas people can sustain.
How we measure impact
Measurement follows the Evaluate stage of ADDIE. Engineers take Incident Response & On-Call Judgment and IT Service Desk and Incident Handling Competence Assessment for Support Teams on AssessAll as a pre-assessment and repeat them at day 90. Leads check in at 30, 60 and 90 days on time to declare, update regularity and closure of review actions, linking the incident management training to how real incidents run.
Pair this program with AssessAll, Bodhih’s AI assessment platform, for pre- and post-program skill measurement.
Frequently asked questions
What is incident management training?
Incident management training is a program that teaches technical teams to respond to service outages in a coordinated way. It covers severity triage, the first 15 minutes, incident roles, status updates, handovers and blameless post-incident reviews. Bodhih runs it through live simulations, so responders rehearse the routine before the next real outage.
What are the roles in incident management?
A typical response has an incident commander who coordinates and decides, a technical lead who directs the fix, a communications lead who updates customers and executives, and a scribe who records actions and times. In small teams one person may hold two roles, but the commander should not also be the main person debugging.
What should you do in the first 15 minutes of an incident?
Declare the incident and set a severity, open one channel or call, name a commander and assign roles. Send a short first update saying what is affected and when the next update will come. Then focus on stabilising the service, such as rolling back a change, before hunting for the root cause.
How do you write an incident status update?
Keep it short and regular. State what is affected, what is known, what is still unknown, what the team is doing and when the next update will arrive. Avoid guesses and early all-clears. Executives need business impact and expected recovery, customers need plain language and engineers need technical detail, so tailor each update.
What is a blameless post-incident review?
It is a meeting after an incident that examines what happened and why, without blaming individuals. The team builds a timeline, identifies contributing causes in systems and processes, and agrees fixes with owners and dates. Because people feel safe to share honestly, the team learns more and similar incidents become less likely.
How do you set up a sustainable on-call rota?
Spread on-call fairly across the team, keep shifts to a length people can manage and give recovery time after night pages. Track how often people are paged and fix noisy alerts. Clear handover notes between shifts help too. The program includes a session where leads review and redesign their own rota.
Is incident management training tied to a specific tool?
No. The program is tool-neutral and focuses on coordination, communication and learning, which apply whatever monitoring or ticketing tools a team uses. Teams can bring anonymised incidents from their own history, and Bodhih customises simulations during the needs analysis, a step it has followed with more than 2,000 companies since 2008.
Can incident management training run online for distributed teams?
Yes. The live virtual version runs as four sessions of three and a half hours, with simulations on a shared call that feels much like a real incident bridge. It suits teams split across Bengaluru, Gurugram, Singapore and overseas offices. For in-person delivery, Bodhih master trainers travel from Bengaluru to your site anywhere in its seven delivery regions.