Blog
The rota says Priya. The page still dials Jordan.
At 03:07 policy prod-sev1 pages Jordan H, whose last day was 14 August. The plan rota for this week names Priya S. The scribe writes that the primary on-call was notified.
At 03:04 on 24 October 2026, the EDR on orders-db-01 flags encryption: about 900 MB written by a process named enc-helper, host still up. At 03:07 PagerDuty fires escalation policy prod-sev1. Marcus T (incident commander) opens the incident-response plan, revised 1 October 2026. The rota for the week of 19 October names Priya S (on-call, platform) as primary and Wei L (infra) as secondary. He calls Priya onto the bridge. She joins at 03:08. The plan says: on Sev 1, the page goes to the primary named on the published rota, and the incident is not acknowledged until that person acknowledges it in the paging tool. Do not write that the primary was notified because they are on the bridge. Priya says she is here, so on-call is covered. Nobody opens prod-sev1. Wei, who owns the policy, is not on the call. At 03:12 the scribe writes that the primary on-call was notified and is on the bridge.
A weak record of those five minutes reads:
Primary on-call notified per the plan. Joined the bridge.
A strong one reads:
24 October 2026, 03:07 to 03:12. Incident-response tabletop. Seats: Marcus T (incident commander), Priya S (on-call, platform). Wei L (infra, owns escalation policy prod-sev1) was not on the call. Inject at 03:07: PagerDuty policy prod-sev1, last edited 2 June 2026 by Jordan H. Step 1 is Jordan H, mobile ending 0148, 10 minutes, then step 2 Priya S. The plan rota, revised 1 October 2026, week of 19 October, names Priya S primary and Wei L secondary. Jordan H's last day was 14 August 2026. The page at 03:07 went to the mobile ending 0148. No answer. Priya joined the bridge at 03:08 because Marcus called the rota. At 03:11 she says she is here, so on-call is covered. The incident in PagerDuty is still unacknowledged at 03:12. Plan: on Sev 1, the page goes to the primary named on the published rota, and the incident is not acknowledged until that person acknowledges it in the paging tool. Do not write that the primary was notified because they are on the bridge. Facilitator stops the sitting before anyone treats the notified sentence as the finding. Nobody acknowledged prod-sev1. Nobody removed Jordan H from step 1. Follow-up: Wei points step 1 of prod-sev1 at the current rota and removes departed users, or writes who owns the policy if he does not, by 7 November 2026.
Both notes say the primary was notified. Only the second shows that the page at 03:07 went to a mobile whose owner left on 14 August, and that the incident was still unacknowledged when the scribe closed the line. The first costs you the wait. On the night this is real, enc-helper keeps writing on orders-db-01 while prod-sev1 rings the mobile of someone whose last day was 14 August, and a reader in March thinks Priya had it at 03:07. Nobody schedules the follow-up, because the file says the plan worked.
The rota is not the policy
Marcus read the document that was revised on 1 October. The tool that dialed read a policy last edited on 2 June, by the person who has since left. The plan did not say page whoever is already awake. It said the primary on the published rota. Priya is that primary on paper. She is step 2 in prod-sev1, behind a 10 minute wait that nobody in the room can answer.
Who should be invited into the room is a different list, in the invite-list post. This sitting starts after she is already on the bridge. The question is which document the pager uses.
Present on the bridge is not an acknowledgement
Priya is talking at 03:11. The incident is unacknowledged. If she treats the bridge as the acknowledgement, step 2 still pages her at 03:17, and the incident stays open until someone presses acknowledge. A headcount on the call is a different fact, covered in the attendance post. This one is whether anyone pressed acknowledge in PagerDuty, and at what time.
If the plan names a rota and does not name the policy that fires, run the free plan self-check before the next sitting. It asks whether you can respond on a 24 x 7 x 365 basis. What to do when the answer is not yes: name the paging tool and the escalation policy, including what happens when the first person does not acknowledge. A plan that names the October rota and does not name prod-sev1 will produce this scribe line every time.
What the packet records
Write both documents in the free evidence template: the rota line for the week of 19 October, policy prod-sev1 with its 2 June edit and step 1, Jordan H's last day, the page at 03:07, that Priya joined at 03:08 and did not acknowledge, that the incident was unacknowledged at 03:12, that Wei was absent, and his follow-up with a date. Hang the inject on the ransomware family in the scenario library. That library walks encryption and whether data left. It does not have a separate family for a stale escalation step. Add this page after the alert, and do not fold it into a line that says the primary was notified. Put the file in the evidence index on the row for that exercise, with the date and the owner, so the next questionnaire finds the policy you did not open. The evidence template sits with the other record formats in the template library.
The record shows that these named people left step 1 of prod-sev1 pointed at Jordan H and wrote that the primary was notified. It does not show that a page will reach Priya at 03:07, and it does not show that she can isolate orders-db-01. A test page, and a containment decision, are different records.
Bottom line: write the policy id and who step 1 still dials. Notified per the plan is the smoothed version. The packet has to show the phone that rang.