Major Incident Management Communication Template: Outage Emails, Alerts and Updates

A major incident management communication template gives your IT team the words before the incident starts. When a core system fails, the service desk is flooded, employees invent their own workarounds and leadership asks for updates every few minutes. This page gives you ready-to-copy templates for each stage, from declaring the incident to the post-incident summary, plus the system outage email and notification templates your staff will actually see. For the wider plan these messages sit in, see our crisis communication plan guide.

What is a major incident management communication template?

A major incident management communication template is a pre-approved message, with gaps for the facts, that IT and operations teams send when a high-impact incident is declared. It sets the structure, tone and audience in advance, so the people managing the incident make decisions about content, not wording, while services are down.

A major incident is the highest category of incident in most IT service management processes: an outage or degradation with significant business impact that needs a dedicated response, its own manager and faster communication than normal incidents. Templates matter because the first message is usually written by someone who is also trying to fix the problem. For the phases of incident communication in more depth, read our incident response communication guide.

What should a major incident communication include?

Every major incident message should state what is affected, who is affected, what people should do now, what is being done, and when the next update will arrive. It should also carry an incident reference and a single contact route, so staff stop raising duplicate tickets with the service desk.

• Incident reference and priority: the ticket or major incident number, so every message and call can be matched to one record.
• What is affected: the service in plain language (for example, 'the payroll system' rather than a server name).
• Who is affected: sites, departments or regions, so unaffected staff can ignore the message.
• What to do now: the workaround, or a clear instruction not to raise a new ticket.
• What is being done: one sentence on the response, without speculation about cause.
• Next update: a specific time, not 'as soon as possible'.
• Contact route: one place for questions, ideally not the service that is down.

Who needs to hear about a major incident?

A major incident needs at least four audiences: the resolver team, affected employees, the service desk, and leadership. Each needs a different message. Resolvers need technical detail, staff need instructions and a workaround, the service desk needs a script, and leadership needs business impact and the expected time to restore.

Major incident communication templates to copy

Replace everything in [square brackets]. Keep each message short: people read the first two lines of an alert, so put the impact and the instruction there.

1. Major incident declared (response team and stakeholders)

Send as soon as the incident is declared. Audience: resolver groups, major incident manager, service owners, duty manager.

2. System outage email template (affected employees)

Send to affected staff within the first few minutes. Only use email if email itself is unaffected.

3. System outage notification template (desktop alert)

Short form for a pop-up alert, lock screen or ticker. Ask for acknowledgement if staff must act.

4. SMS or mobile push outage message

Under 160 characters, for staff away from their desks or when the network is affected.

5. Status update template

Send at the agreed interval, even when nothing has changed.

6. Leadership and stakeholder briefing

For executives and business owners. Lead with business impact, not technical detail.

7. Resolved and all-clear message

Send to everyone who received the original notification.

8. Post-incident summary

Send within a few working days, once the review is complete. Keep the employee version short.

How often should you send major incident updates?

Send updates at a fixed, published interval for the whole incident, even when there is no new information. Many IT teams agree a cadence by priority, such as every 30 minutes for a critical outage and every hour for a high-priority one. Stating the time of the next update is what stops repeated calls.

These intervals are examples to adapt, not a standard. Agree them with your service owners in advance, write them into your major incident process, and include the next update time in every message.

Which channel should you use when the outage affects email?

Use a channel that does not depend on the failed system. If email, Microsoft 365 or the network is down, an outage email will not arrive. Desktop alerts delivered by a separate client, SMS, mobile push and digital signage reach people independently, and acknowledgement tracking shows who has actually seen the message.

The risk is greatest when the incident hits the tools people normally rely on: email, Microsoft Teams or the network itself. We cover this problem in detail in what happens when the channel you use to report outages is the outage. In practice, most organisations combine a desktop alert for logged-in staff, SMS notifications for people on the move, and a corporate lock screen message for anyone who logs in later.

Sending major incident communications with Heed

Templates only help if they can be sent in seconds. Heed for major incident management lets incident managers trigger pre-built alert templates instantly across desktop, mobile, SMS, lock screen and digital signage, and target them by department, location or Active Directory group. Acknowledgement tracking confirms who has seen each message.

Heed integrates with ServiceNow and monitoring platforms, so incident alerts can be triggered automatically from ITSM events. It is available as a true on-premises deployment or in the cloud, and Heed is ISO 27001 certified. See how an enterprise bank automated major incident communications in our banking case study, or read more about IT outage notification software.

Want to see your templates as live alerts? Book a demo and we will show you how a major incident message reaches every employee, even when email is down.