Incident Scribe (Scribe)
The person responsible for accurately documenting the timeline, actions, and decisions during an incident.
The person responsible for accurately documenting the timeline, actions, and decisions during an incident.
The Historian of the Crisis
The Incident Scribe is often the most underrated role in incident response. While the IC directs and the responders fix, the Scribe records. Their job is to create a high-fidelity timeline of what happened, when it happened, and who did it.
Why is this Critical?
After a 4-hour outage, human memory is terrible. We conflate events, misremember decision timing, and forget critical context. The Scribe ensures the Post-Incident Review (PIR) is based on facts, not feelings.
What to Record
- State Changes: "Status page updated to Investigating at 14:02 UTC."
- Key Decisions: "IC decided to roll back instead of patch forward at 14:15 UTC."
- Hypotheses: "Database lead suspects lock contention at 14:20 UTC."
- Actions: "Restart command issued at 14:25 UTC."
ExThe "Ghost" Bug
"A system crashed, was restarted, and the logs were wiped by the restart script. No one knew what caused it."
Why Incident Scribe Matters
Without a Scribe, the post-mortem will be based on faulty memory.
Allows the Incident Commander to focus on decision making, not note-taking.
Creates a legal and technical record of the event.