The first hour of a crisis: stabilize, learn, communicate

When it’s on fire, the order of your moves matters more than any single move — contain first, then learn, then speak.

The idea

“Walk me through your next thirty minutes” isn’t asking for the root cause. It’s testing whether you can stay calm and sequence. The reliable loop: stop the bleed, split facts from unknowns, set a communication cadence, and make the reversible calls now while parking the irreversible ones until the facts are in.

Two things move underneath every incident: the damage that accrues while the problem is uncontained, and the trust of everyone watching how you handle it. Speaking before you know, or promising an update and going quiet, spikes one and drains the other.

How it works

1. 1Contain. Stop the bleed before anything else — roll back, flip the flag, take the path offline. Damage accrues every minute the cause is live, so the fastest safe containment is worth more than a perfect diagnosis.
2. 2Learn. Assign someone to fact-finding and keep two lists: what you know and what you don’t. You can only communicate honestly, and decide safely, from that split.
3. 3Communicate on a cadence. Acknowledge early — even “we’re aware, investigating, next update in 15 minutes” buys calm. Then hit that time, every time, even if the update is “still working on it.”
4. 4Decide reversibly. Make the reversible calls now; explicitly park the one-way doors (public blame, permanent deletion, legal statements) until the facts are confirmed.

A calm 30-minute schedule tends to look like this:

min  0 ── contain: roll back the bad deploy      (stop the bleed)
min  5 ── learn:   assign fact-finding           (facts vs unknowns)
min  9 ── comms:   internal note + "update in 15"(set the cadence)
min 12 ── align:   brief the exec on facts so far
min 15 ── comms:   public statement, once facts are in
        ── parked: refunds / data purge          (irreversible -> later)

External statements wait for facts; internal acknowledgement does not. That single distinction protects trust more than eloquence ever will.

When to use it

Fits	The trade-off
Outages, security incidents, a bad deploy, a data mix-up, a PR flare-up — any “it just broke, what now” prompt.	This is a bias-to-action loop for the first hour, not a root-cause investigation. The blameless post-mortem comes later — say so, don’t skip it.

Watch out for

• Announcing before you know. A confident public statement that turns out wrong costs more trust than a slower, honest one. Speak outward only after the facts are in.
• Promising a time, then going silent. The cardinal sin of incident comms. If you said “update in 15,” send something at 15 — even “no news yet, next update in 15.”
• Reaching for the one-way door. Under adrenaline the irreversible lever (mass refund, data purge, naming a culprit) feels decisive. Park it; the reversible move buys you the same time without the regret.
• Diagnosing before containing. Debugging the burning building. Roll back first; understand why afterwards.
• One-person heroics. No fact-finder assigned, no cadence, no exec brief — just you typing. Delegating and communicating is the senior move.

Worked example

“A deploy at 2:00 starts double-charging customers on payment retries. Walk me through your next thirty minutes.” A strong answer sequences it: 2:00 — roll the deploy back immediately; the bleeding stops even before I know the exact cause. 2:05 — I put someone on fact-finding: how many customers, over what window, which charges. 2:09 — internal note to support and leadership: “retries double-charged between 1:50 and 2:04, rolled back, refund plan by 2:20, next update in 15.” 2:15 — once we’ve scoped it, a public status update and proactive refunds to the affected list. What I don’t do at 2:01 is email every customer an apology or purge the charge records — those wait for the facts.

Check yourself

Prep Room · the interviewer is listening for order and composure, not a miracle fix.