INCIDENT RESPONSE
War Room
A dedicated physical or virtual space where incident responders coordinate during major incidents.
By Niketa Sharma, Founder at Runframe·Last updated Mar 2026
War Room
A dedicated physical or virtual space where incident responders coordinate during major incidents.
"The Eye of the Storm"
A War Room is where the team gathers to fight the fire. In the remote world, this means a Zoom link and a Slack channel (e.g., #inc-123).
Rules of Engagement
- Strict Discipline: Only relevant chatter. "I am checking the logs" (Good). "Wow, this is crazy" (Bad).
- Single Source of Truth: The Incident Commander (IC) speaks for the room.
- Scribe: Someone should be writing down what is happening (for the timeline later).
When to Open a War Room
- SEV0/SEV1: Always. Immediate video call.
- SEV2: Optional (Slack channel is usually enough).
- SEV3: Never.
ExThe Silent Zoom
“A team jumped on a Zoom call for a SEV1 but no one spoke for 10 minutes because they were debugging.”
Impact
New joiners didn't know if work was happening. Executives panicked.
Resolution
The IC established a rule: "Status update every 15 minutes, even if the status is 'Still looking'."
Why War Room Matters
War rooms create focus and facilitate rapid communication during high-stakes incidents.
Even remote teams benefit from designated war room channels and video calls.
Common Pitfalls
Side Channels
Two engineers solving the problem in a private DM. This hides information from the group. Keep it public.
How to Use War Room
💬
Dedicated Channel: Slack channel for each incident.
📹
Video Call: Always-on video for coordination.
📊
Shared Dashboards: Everyone sees the same metrics.