Set Incident Service Expectations Before a Crisis Tests Them

Incident service expectations need customer decisions before an urgent discussion changes everyone's attention. An MDR consultant does not need to predict an event. Useful discovery identifies how a customer wants people to communicate, which internal approvals matter, and where escalation belongs. Those choices form a route a customer recognizes. Broad reassurance does not answer who reads a first notice or who approves a change.

Start with a defined fictional situation. Northline Mutual, a fictional insurer, wants a contact route for a concern involving access to a public customer portal at 10:45 in the evening. The consultant asks who receives the first call and what information helps the first recipient decide whether more people should join. Dana, Northline's security manager, asks for the affected service, a brief reason for contact, and any customer action request. Her answer establishes content and ownership together.

Do not merge a notification with an update or a customer action request. A notification seeks attention. An update describes ongoing review. An action request asks a customer owner for a choice or approval. Recipients often treat a combined message as background information and miss a decision they need to make. Ask how the customer wants those purposes separated. One group might prefer clear verbal openings. Another might choose a written label agreed through their own process.

Acknowledgement deserves an explicit question. A sent message does not prove a customer has seen or understood a request. Ask who confirms receipt, which channel carries confirmation, and what route follows when no reply arrives. This discussion records customer communication preferences rather than a promised response outcome. Ask Dana who validates the route after discovery. She names the security duty lead as acknowledgement owner for the fictional portal situation.

Next, identify approval boundaries in ordinary language. Ask, "Which customer actions need approval before anyone proceeds?" Then ask who holds each decision during business hours and outside normal hours. Dana might provide security context without authority over a portal change. An application owner might approve one service action but need a business owner for a decision affecting customers. Write those distinctions down. A job title alone rarely describes the decision path.

Northline's legal lead, Omar, joins part of the fictional discussion. Omar does not need every overnight call. He wants notice when an external communication question arises. The consultant asks Dana and Omar who decides when such a question exists. Dana says her security group identifies a possible question, then Omar decides whether legal input belongs in the customer's internal process. This avoids placing Omar on a route designed for technical review and leaves his role clear.

Words such as serious need an example. When Dana says, "Call me for anything serious," ask for one fictional trigger deserving a call and one situation suited for a next workday update. Dana chooses a possible access concern involving the public portal for the first category. A routine evidence review belongs in a scheduled update. Those choices stay subject to customer review. They do not create a fixed severity scheme or a service guarantee.

Timing works best when attached to a chosen situation. Avoid asking for one universal response window. Ask, "For the fictional portal concern, when does your duty lead expect a first call?" If Northline lacks an answer, mark an open item. An invented number creates false confidence and tends to spread into later notes. The customer should select a timing preference through its own process and identify where an approved version belongs.

People who need awareness should stay distinct from people who make decisions. An operations lead might need notice because a customer choice affects staffing. A communications contact might need awareness before customers ask questions. Neither role automatically approves an action. Ask who receives information, who asks for more context, and who confirms an internal decision. A useful route reflects those separate jobs rather than adding every interested person to an overnight call.

Prepare for a missing contact. People travel, move roles, and miss calls. Ask who owns primary and alternate contacts, how often the customer reviews each route, and how an update reaches the service relationship. Northline finds a mismatch between its security roster and application escalation record during this exercise. Dana accepts responsibility for bringing both records to Wednesday's customer review. The consultant records Dana's follow up, not an assumed alternate name.

Play a fictional sequence back in everyday language. "At 10:45, the security duty lead receives a call about the portal situation. Dana's group reviews context and decides whether an internal customer action request exists. Omar receives notice when an external communication question appears. A separate update goes out when no customer decision is requested." Invite correction after every sentence. Hearing the route often exposes an owner who was missing from a broad description.

Add a late participant as a second test. A regional technology leader joins after Dana and Omar have spoken. Ask who gives earlier context to the leader and whether Dana or Omar needs notice before details reach a new participant. Northline decides Dana gives a short factual handoff, while Omar receives notice only when the handoff includes an external communication issue. This decision reduces reliance on partial memory during an active conversation.

Discovery does not settle every operational detail. Customer approved documents and customer policies govern their internal choices. The consultant's role involves surfacing choices, identifying unclear ownership, and assigning a traceable next step. A visible blank often serves the customer better than wording which sounds complete but lacks an owner. Keep unresolved items short, specific, and assigned to a customer contact.

Use a practice conversation to strengthen discovery questions. Let a buyer say, "Call us for anything serious." Ask, "Which fictional portal situation deserves a call?" Then ask, "Who decides whether your team needs to act?" Follow with, "Who reviews this written route before service begins?" Each question asks for a customer choice. None asks a consultant to invent a policy or speak for an internal leader.

For the final practice step, Dana writes two sentences for Wednesday's review: a portal call trigger and an acknowledgement owner. Omar marks where his notice enters the route. The consultant reads both sentences aloud, adds a blank beside any unresolved approval, and asks Dana to assign the blank before the meeting ends. The next discussion begins with Dana's revised route, not a repeat of the first discovery call.