Incident Communication
1) Goals and principles
Goals: maintain trust, accelerate recovery, reduce reputational and regulatory risk.
Principles:- Truth first, speed second but fast - truthfulness without delay.
- Single Source of Truth - Consistency of facts.
- Auditability: everything is fixed, reproducible.
- Empathy for users, clear next steps and ETA/ETR (if any).
- Audience segmentation: players, VIPs, partners, affiliates, providers, regulators, internal team.
2) Roles and Responsibilities (RACI)
Incident Commander (IC) - incident owner, prioritization, solutions.
Comms Lead (CL) - manages communication, formulates and releases updates.
Ops/SRE Lead - technical facts, recovery progress.
Legal/Compliance - regulatory requirements and risk statements.
Support Lead - routing of calls, macros, VIP-list.
Partner Manager - communication with PSP/KYC/game providers, affiliates.
Social/PR Lead - social networks and press statutes.
Rule: one Comms Lead per incident, replacement is issued explicitly.
3) Classification of incidents and SLOs by updates
Rules:- The first update is published even without details: recognition, zone of influence, the next update time.
- If there is no new progress, we write that there are no updates yet, the new slot remains.
4) Channels and their purpose
Var room (chat/video marketing): IC, techlides, CL; all solutions and updates are there.
Status page: public SoT: incident, impact, updates, components.
Support channels: macros for chats/tickets, VIP prioritization.
Partners/providers: closed mailings and channels with PSP/KYC/game providers.
Regulators: predefined destinations/portals, SLA notifications.
Social media: Short messages linking to the status page.
Internal channels: # exec-briefing for management; # gtm for marketing.
5) Stakeholder map
Players (mass, VIP, high-risk segments).
Partners (affiliates, studios, PSP/KYC/AML, streamers).
Regulators (by jurisdiction).
Banks/Akaviers (for PSP incidents).
Internal (CS, Finance, Legal, Sales/BD, Marketing, Data).
6) First hour script (gold standard)
1. T + 0-5 min: IC confirmed, incident card open, var room created.
2. T + 10 min (P1 )/T + 20 (P2): first public update: confirmation of the incident, symptoms, affected regions/functions, next update slot.
3. T + 15-30 min: mailing to partners/internal sammari; macros to support.
4. Every 15-30 min: progress updates, workaround (if any), ETA/ETR when available.
5. Up to 60 min: escalation decision (geo-feiler, PSP switching, feature degradation), fix in prod.
7) Message templates
7. 1 First Public Communication (P1)
Where and who will be affected: regions/providers/platforms.
What we're doing: Team working on recovery, X/Y providers involved.
Next update: no later than HH: MM (local user time).
Apologies/empathy: understand the inconvenience, thank you for your patience.
7. 2 Status update
Impact: decreased/unchanged; metrics [p95/successful authorizations].
What's Next: Next Steps/Expected Milestone.
Next update: HH: MM.
7. 3 Closing the incident
Reason: briefly (no sensitive details).
Measures: what they did to prevent repetition.
Compensation (if applicable): credits/bonuses/commission write-offs + how to get.
Post-mortem: to be published before D + X (if policy suggests publicity).
7. 4 Social networks (short form)
7. 5 Partners/Affiliates
7. 6 Regulator
8) Do / Don’t
Do: quickly acknowledge the problem; give the time of the next update; Use the same numbers coordinate text with Legal/Compliance for PII/Finance.
Don't: Promise deadlines without certainty; indicate the perpetrators; Disclose confidential architecture argue in the comments - send to the status page.
9) Localization and formatting
Languages: minimum EN + key GEO (e.g. TR, ES, PT-BR).
Clock in user locale + UTC in parentheses.
Simple structure: title → impact → progress → next update.
Availability: short paragraphs, bulleted lists.
10) Integration with operations
Comms Lead is present in the var room with the right to ask clarifying questions.
The comma plan is related to KRI/SLO: publishing metrics (e.g. PSP authorization, p95).
Work instructions for Support: macros, FAQ, VIP priority.
Triggers of financial measures: compensation, cancellation of commissions, extension of tournaments.
11) Comms Lead checklist (each update)
1. Confirm level (P1-P4) and affected components.
2. Specify the impact in numbers (example: "up to 35% of deposits in GEO-X").
3. Check wording with IC/Legal.
4. Publish to status page → send to channels.
5. Set the next update timer.
6. Pledge the version of the message (time, author, diff).
12) Communication Quality Metrics (KPI/KRI)
MTTA-Comms: Time before first public communication.
Cadence adherence: compliance with the declared update interval.
Consistency: discrepancy between channels (0 - target).
CSAT of the incident/volume of repeated calls to support.
Share of public post-mortem incidents on time.
The time that macros were released for the support after the incident started.
13) Post-incident communication
Internal Management Report: Total Scale, Reasons, Lessons, Costs.
Public post-mortem (if politics allows): facts, time lines, prevention measures.
Individual letters to VIP/partners offering compensation and contacts.
14) Special scenarios
Data/security incidents: communication only through approved Legal/Compliance channels; regulatory notice periods are possible.
Provider failures (PSP/KYC/games): neutral wording, no charges; fix the dependency and work on the bypass.
Sports peaks: pre-prepared message package and FAQ for the period of matches/tournaments.
15) Implementation Roadmap (6-8 weeks)
Ned. 1-2: approval of roles, launching a status page, preparing templates and macros, training workshop.
Ned. 3-4: integration with the var-room, checklists, localization calendar, list of regulatory contacts.
Ned. 5-6: tabletop P1/P2 with update timers, template correction.
Ned. 7-8: Comms-KPI metrics and dashboards, public post-mortem regulations, compensation catalog.
16) Artifacts and patterns
P1/P2/P3 Comm Plan (PDF/Confluence) with SLA updates.
Status-update template.
FAQ for support on type incidents.
Affiliate mailing (tracking/payout impact).
Register of contact points (regulators/providers/media).
Log of message versions (timestamp, channel, author, diff).
17) Antipatterns
Silence> 30 min at P1.
Different numbers in different channels.
"We'll fix everything soon" without the time of the next update.
Technical jargon without translation into user language.
Public allegations by providers.
Total
Well-functioning communication in incidents is a discipline of time, a single voice and transparency: a quick first update, regular and consistent messages, clear expectations for users and partners, managed publicity and mandatory post-incident notifications. Such a circuit protects revenue and reputation, increasing confidence in the platform even in moments of failure.