Major incidents can last for hours or even days. No single person can remain focused and effective as an Incident Commander for that long. Fatigue degrades judgment — the same way a surgeon shouldn't perform a 12-hour operation alone, an IC shouldn't hold command indefinitely. Recognizing when to hand off is itself a mark of a skilled IC.
A Formal Transfer of Power
A handoff is not just someone else logging on to the call. It is a deliberate, explicit transfer of authority. An informal handoff — where the original IC quietly steps back and a new person quietly steps forward — is dangerous because the team may not know who to direct questions to, and both people may assume the other is making decisions.
The handoff follows a structured process:
Step 1 — Private Briefing: The outgoing IC briefs the incoming IC privately (in a side channel or direct message) on the current status. This briefing should cover:
- What is currently broken and what is the working theory of cause?
- What active workstreams are in progress and who owns each?
- What decisions have already been made and why?
- What open questions or blockers exist?
- What is the recommended next action?
Step 2 — The Public Announcement: The outgoing IC announces to the entire response team in the main incident channel:
"Attention all: I am now handing over Incident Command to [Name].
[Name] is now the Incident Commander and is in charge.
I am stepping back. Direct all questions and updates to [Name]."
Until that public announcement is made, the original IC retains full authority and responsibility — even if they have already briefed the incoming IC privately.
Step 3 — Acknowledgment: The incoming IC explicitly acknowledges in the channel: "Confirmed, I have Incident Command."
When to Hand Off
- After 2–3 hours of active command (fatigue threshold)
- When the incident shifts domain (e.g., from a network issue to a database issue, and the new IC has deeper relevant expertise)
- When the original IC needs to escalate to a different role (e.g., they need to become an SME to investigate something critical)
A common interview question is: "What do you do if two people both think they are the Incident Commander?" The correct answer is that this situation should never arise if handoffs are done properly — but if it does, the resolution is immediate: one person explicitly yields in the public channel. The team cannot function with ambiguous authority. Interviewers are testing whether you understand that clarity of command is more important than who specifically holds it.