title: Incident Communications Templates version: 1.0 owner: Pocket PMO Ltd last_reviewed: 13 Jul 26 status: Approved audience: Public (Trust Centre) and Internal
Incident communications templates
Pocket PMO uses the following communications templates during a live incident. They are published so customers can see exactly how they will be told, and in what shape, if something goes wrong. Every incident goes through at least three notifications: Investigating → Update → Resolved. A Post-incident Review follows within 5 working days for any Sev-1 or Sev-2 incident.
Timings below are commitments, not aspirations. All timestamps in messages use UTC.
Severity definitions
| Sev | Meaning | Example | Customer-facing SLA |
|---|---|---|---|
| Sev-1 | Total outage or confirmed data-integrity/security incident | Login broken for all users; suspected data breach | First notice within 30 minutes of confirmation |
| Sev-2 | Major feature unavailable for many customers | AI Team unresponsive; PDF export failing globally | First notice within 60 minutes |
| Sev-3 | Degraded performance or minor feature broken | Slow dashboards; a single report template errors | Notice on the next status update; not always email |
| Sev-4 | Cosmetic / single-tenant / self-resolving | Layout glitch on one page | Not customer-communicated |
Template 1 — Investigating (Sev-1 / Sev-2)
Subject: [Investigating] {short description} — Pocket PMO
We're currently investigating an issue affecting {feature or scope} on Pocket PMO.
- What we know: {one-line description of the symptom}.
- Who is affected: {"all customers" / "customers using X" / "a small percentage of customers on Y"}.
- What we're doing: Our engineering team is actively investigating and we've assigned an incident commander.
- What you should do: {"No action needed" / specific workaround}.
We'll post the next update by {HH:MM UTC} on https://pocketpmo.co.uk/trust/status. If you have questions in the meantime, reply to this email or contact admin@pocketpmo.co.uk.
— The Pocket PMO team
Template 2 — Update (in-progress)
Subject: [Update] {short description} — Pocket PMO
Update on the incident affecting {feature or scope}.
- Current status: {one line — "we've identified the cause" / "a fix is being deployed" / "we're monitoring recovery"}.
- Progress since last update: {two or three concise bullets}.
- Impact right now: {"resolved for X% of customers" / "still degraded"}.
- Next update: by {HH:MM UTC}.
We'll continue posting updates on https://pocketpmo.co.uk/trust/status.
— The Pocket PMO team
Template 3 — Resolved
Subject: [Resolved] {short description} — Pocket PMO
The incident affecting {feature or scope} is now resolved.
- What happened: {one-sentence root cause in plain English}.
- Duration: {start UTC} to {end UTC} — approximately {duration}.
- Impact: {"all customers were unable to X between …" / "approximately Y customers experienced …"}.
- What we've done: {one line on the fix}.
- What's next: A full post-incident review will be published within 5 working days at https://pocketpmo.co.uk/trust/status.
Thank you for your patience.
— The Pocket PMO team
Template 4 — Security incident notification (UK GDPR Article 34)
Used only for a confirmed personal-data breach that is likely to result in a high risk to the rights and freedoms of natural persons. Sent within 72 hours of the moment we become aware.
Subject: [Important] Security incident affecting your Pocket PMO account
We are writing to inform you of a security incident that may have affected personal data associated with your Pocket PMO account. We are notifying you because UK GDPR (Article 34) requires us to, and because we believe you should know.
What happened On {date UTC}, {plain-English description of the incident}.
What information was involved {"Names, email addresses, and hashed passwords." / specific categories}. To the best of our current knowledge, {no financial data / no payment card data / no plaintext passwords} were involved.
What we're doing
- We've {contained / patched / rotated credentials / …}.
- We've engaged {"an external incident-response firm" / "the ICO"} where appropriate.
- We've notified the Information Commissioner's Office (ICO).
What you should do
- Reset your Pocket PMO password at https://pocketpmo.co.uk/reset.
- Enable two-factor authentication from Settings → Security if you haven't already.
- If you use the same password anywhere else, please change it there too.
How to contact us For any questions relating to this incident: admin@pocketpmo.co.uk. You can also contact the ICO at https://ico.org.uk/make-a-complaint/.
We're sorry this happened.
— The Pocket PMO team
Template 5 — Post-incident review (published within 5 working days)
Structure:
- Summary — 3 sentences.
- Impact — who, what, how long, how many.
- Timeline — UTC timestamps from first signal to resolution.
- Root cause — plain English, no blame.
- What went well — always at least one item.
- What we're changing — concrete actions with owners and due dates.
- Contact — how to ask us follow-up questions.
Post-incident reviews are published at https://pocketpmo.co.uk/trust/status and remain publicly accessible.
Internal escalation ladder
| Time from confirmation | Action |
|---|---|
| 0 min | Incident commander assigned; #incidents channel opened |
| 15 min | First customer-facing update drafted |
| 30 min (Sev-1) / 60 min (Sev-2) | First notification sent |
| Every 30 min | Status update on https://pocketpmo.co.uk/trust/status |
| Resolution | Resolved notice sent within 30 min of full recovery |
| +5 working days | Post-incident review published |
Version history
| Version | Date | Change |
|---|---|---|
| 1.0 | 13 Jul 26 | Initial publication. |