Chapter 26 — Operational handoff and communications practice
Lesson map
Lesson 26 published. Map, example, EX076.
flowchart TD
N0["Learning outcomes and connection"]
N1["26.1 Handoffs"]
N2["26.2 Status updates"]
N3["26.3 External communication"]
N4["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX076"]
Logical drawing
flowchart LR
N0["Learning outcomes and connection"]
N1["26.1 Handoffs"]
N2["26.2 Status updates"]
N3["26.3 External communication"]
N4["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX076"]
[Learning outcomes and connection]
|
v
[26.1 Handoffs]
|
v
[26.2 Status updates]
|
v
[26.3 External communication]
|
v
[Chapter synthesis]
|
v
[Worked example] --> [Exercise EX076]
Learning outcomes and connection
You will be able to (1) perform shift and ownership handoffs that lose nothing; (2) write status updates for different audiences at a set cadence; and (3) coordinate communication with residents, suppliers and authorities through the people authorized to speak. Chapter 25 designed workflows; many fail at the seams — between shifts, teams and audiences.
26.1 Handoffs
Information is lost at handoffs. A structured handoff covers: case summary and current severity; scope and what is known/unknown; actions in progress with owners and expected completion; pending decisions and who owns them; risks and things to watch; next update times; and the explicit acceptance of ownership by the incoming person. Healthcare's SBAR (situation, background, assessment, recommendation) is a well-known structure that adapts well. The handoff is written in the case and spoken live; the incoming lead reads back key points.
26.2 Status updates
Set a cadence by severity (S1: every 60 minutes internally; S2: twice daily) and keep it even when there is "nothing new" — silence breeds rumour. Tailor to audience: technical responders need indicators and tasks; service owners need impact and expected restoration; executives need facts, decisions required, risks and next update; the service desk needs what to tell callers. Every update separates facts, current assessment and next steps, and gives the time of the next update. The Google SRE book's incident management chapter recommends a living incident document and regular updates for the same reasons.
26.3 External communication
Residents, media, regulators, suppliers and law enforcement are contacted only by people the charter authorizes, with the communications office, counsel and privacy officer as required. Technologists supply accurate facts and review drafts for technical correctness. Regulatory deadlines (for example the GDPR's 72-hour notification to the supervisory authority where feasible) are tracked in the case from the recorded awareness time; the determination belongs to the privacy officer and counsel. In FCS-260, the director held the decision on telling residents about the billing delay, with communications drafting the text. The awareness time recorded the previous morning started the clock that the privacy officer tracked while waiting for the egress review.
26.4 Worked example (synthetic): night-to-day handoff for FCS-260
Fictional. At 07:00 the night lead hands FCS-260 (ransomware on fs-01) to the day lead.
Situation: S1; billing file processing down since 06:10 yesterday; fs-01 isolated; fs-02 clean by scan. Background: initial access likely a shared admin credential (assessment, moderate confidence); credential rotated 23:40. Assessment: restore of billing share from immutable copy 60% complete, ETA 10:00; unknown whether files were copied out — egress logs under review by R. Lin, due 09:00. Recommendation / pending decisions: director to decide at 09:30 whether to inform residents of billing delay (draft ready with communications); privacy officer awaiting egress result for notification assessment; awareness time recorded 08:20 yesterday. Watch: any sign-in by old admin credential (alert R-31 active). Next updates: executive 09:30, service desk 08:00.
Day lead read back the pending decisions and accepted ownership at 07:12; the case shows both names and the time.
26.5 Common errors and limits
- Handoffs by chat message without acceptance.
- Updates that mix facts and speculation.
- Technologists speaking to media or residents directly.
- Missing the start of a regulatory clock because awareness time was not recorded.
The FCS-260 handoff avoided the first error by using a structured note and recording the day lead's acceptance at 07:12. Its assessment of the initial access route was labelled with moderate confidence, which keeps facts and speculation apart. The awareness time was recorded, so the regulatory clock was known to both leads.
Exercises — chapter 26
Attempt each exercise before opening the worked results. Every case, organization, person, address and number in an exercise is synthetic unless a cited public source is named.
EX076 — Handoff note. Steps: write an SBAR handoff for FCS-214 at end of day. Rubric: 3 = all four parts, open actions with owners, pending decisions, watch items, explicit acceptance; 2 = missing acceptance; 1 = narrative; 0 = none.
EX077 — Three audiences. Steps: write 50-word updates on FCS-260 at 09:30 for the executive, the service desk and the technical team. Rubric: 3 = each tailored with facts/assessment/next and next-update time; 2 = two tailored; 1 = same text; 0 = none.
EX078 — Clock tracking. Steps: define the case fields needed to track external notification deadlines. Rubric: 3 = awareness time and who recorded, applicable regimes (determined by privacy/counsel), deadline per regime, owner, status, sent time and reference; 2 = missing owner; 1 = one field; 0 = none.
Chapter synthesis
Make handoffs structured, written, spoken and accepted; keep a steady update cadence tailored to each audience with facts separated from assessment; and leave external communication to authorized people while you supply accurate facts and track deadlines from a recorded awareness time.
Continue studying — chapter 26 of 30
← Chapter 25 · Course chapter index · Chapter 27 →
Continue to the next authored lesson.