IR-003 critical on-call-escalation

Contact list for emergencies

During an incident, you shouldn't be hunting for phone numbers. A readily accessible contact list with multiple reach methods saves critical minutes.

Question to ask

"If Slack is down, how does your team reach each other?"

Pass criteria

  • Contact list exists with key people
  • Multiple contact methods per person (phone + Slack/email)
  • Accessible during outages (not solely in a system that could be down)

Fail criteria

  • No contact list
  • List exists but only has email
  • List is only in production systems

Verification guide

Severity: Critical

During an incident, you shouldn't be hunting for phone numbers. A readily accessible contact list with multiple reach methods saves critical minutes.

Check automatically:

  1. Look for contact documentation:
# Search for contact lists
grep -riE "contact|emergency|phone|mobile|\+1|\+44" docs/ runbooks/ README.md CLAUDE.md CONTACTS.md ONCALL.md --include="*.md" 2>/dev/null

# Look for dedicated contact files
find . -maxdepth 3 -name "*contact*" -o -name "*emergency*" -o -name "*oncall*" 2>/dev/null | grep -v node_modules

Ask user:

  • "Where's the emergency contact list stored?"
  • "Does it include multiple contact methods (phone, Slack, email)?"
  • "Is it accessible when your primary systems are down?" (not just in a wiki that might be offline)

Cross-reference with:

  • IR-001/IR-002 (on-call and escalation) - contact list supports both
  • IR-004 (incident management tool) - tool often stores contacts
  • Section 12 (monitoring) - alerting tools need contact info configured

Pass criteria:

  • Contact list exists with key people (on-call, escalation contacts, vendors)
  • Multiple contact methods per person (phone + Slack/email)
  • Accessible during outages (not solely in a system that could be down)

Fail criteria:

  • No contact list
  • List exists but only has email (useless at 3am)
  • List is only in production systems (inaccessible during outage)

Evidence to capture:

  • Location of contact list
  • Contact methods included (phone, Slack, email, etc.)
  • Whether it's accessible offline/during outages

Section

35. Incident Response

API & Security