Formal incident command arrived in software via large tech organisations. At five engineers, the full framework is absurd. The underlying insight is not.
The problem it solves
During a significant incident, several things need to happen at once: someone diagnoses and fixes, someone keeps customers informed, someone answers "any update?" from everyone else, someone decides whether to roll back. With one person, communication always loses, and the result is a status page that went red at 14:22 and was never updated again.
The minimum viable version
One person coordinates. One or more people fix. These are different people. The coordinator does not debug. Their job is to know the current state, communicate outward, bring in help, and make the calls that are not purely technical.
When to appoint one
Not for everything. Useful triggers: more than one person is working on it, it has been going more than twenty or thirty minutes, it is customer-visible, or the fix carries risk. Say it out loud: "I'll coordinate, you two work the problem."
What the coordinator actually does
Maintains the current picture. Owns external communication on the promised cadence. Shields the responders — every "any update?" goes to the coordinator. Tracks time. Makes the non-technical calls. Records the timeline as things happen.
What the coordinator does not do
They do not debug. The moment the coordinator opens a terminal, the role has collapsed and communication stops. It helps to name it as a discipline: your job right now is to not fix this.
Rotating the role
Do not let one person always coordinate — they will be pulled into every incident, and coordination is a skill that improves with practice. A reasonable convention: the on-call person coordinates by default, and whoever has the most context fixes.
Handover during long incidents
Anything past a couple of hours needs a structured handover: what is broken and the current impact, what has been tried and ruled out, what is being tried now and by whom, what external communication has gone out and when the next update is promised, and what decisions are pending. Do it verbally and then write it down.
The version that fits on a card
If more than one person is working on it, or it has been going twenty minutes, someone says "I'll coordinate." That person stops debugging, keeps a running note, updates the status page, absorbs the questions, and watches the clock. That is it.