How an Incident Commander handles CEO inquiries during a major incident

When a major outage hits, the clock isn’t just ticking—it’s screaming. The screen shows red alerts, teams sprint toward dashboards, and the Incident Commander steps into the center of the storm. Then, in the middle of the chaos, a CEO asks a question. What’s the right move? How should you respond so the incident gets fixed quickly without turning a crisis into a longer public relations moment?

Here’s the clean answer that keeps the focus where it belongs: tell the CEO that the incident takes priority and that questions will be addressed later. It sounds almost too simple, but in practice this boundary is what lets responders stabilize the issue fast. Let me explain how and why this works, and how you can implement it in real-time without tripping over nerves or ego.

A quick reality check: what the CEO actually wants

During a major incident, executives aren’t trying to micromanage. They want to know impact, what’s being done now, and when the service will return to normal. They also want clarity and confidence that the team isn’t chasing shiny swords while critical systems stay down. The tension comes from two directions: time (the outage isn’t waiting) and perception (stakeholders want to feel informed). The best move keeps the incident front and center, while still ensuring stakeholders aren’t left in the dark.

The right approach in a single, clear line

Inform her that the incident takes priority, and questions will be addressed later.

That sentence isn’t meant to shut down dialogue. It’s a boundary that preserves focus and protects the integrity of the response. It says, in effect: “We hear you. Right now we’re solving the problem. We’ll circle back with a focused update you can use.” Now let’s turn that into behavior you can rely on in the heat of a crisis.

How to implement this in the moment

• Acknowledge, then set a brief boundary

The moment a CEO’s question lands, acknowledge it with respect. “I understand this matters. Right now we’re in response mode and need to prioritize containment and recovery. I’ll provide a concise update in the next 5 minutes.” Short, calm, and concrete. If you’re already in a war room or chat channel, keep the acknowledgement visible and move on to the action.

• Establish a single point of contact for inquiries

In a real incident, you don’t want a parade of voices pinging the CEO. Assign a designated liaison or Public Information Officer (PIO) who handles executive questions, customer updates, and internal comms. This person becomes the “bridge” between incident work and leadership expectations, freeing the Incident Commander to lead the resolution.

• Create a cadence that’s easy to digest

Nothing kills momentum like a flood of data you can’t triage. Agree on a tight cadence for updates—every 5 to 10 minutes is common in the early moments of a major incident. The update should cover three things: impact (what’s down or degraded), containment (what actions are underway), and next steps (what we’ll do in the next interval). If you can, publish this in a single source of truth—one dashboard, one slide, one page—that leadership can reference without chasing multiple threads.

• Keep the data tight and the language calm

Executives don’t need every technical detail. They want a clear, concise picture. Use plain language: “Two services are down, 8,000 users affected, primary issue is database latency, we are applying a fix and validating results.” Avoid speculation and jargon unless it adds real clarity. The goal is confidence, not confusion.

• Turn inquiries into a status-report opportunity, not a detour

If the CEO asks a question that requires deeper digging, acknowledge and say you’ll follow up after the current update. The follow-up can be a precise, written note or a scheduled briefing once you’ve got a stable situation. This approach keeps the momentum and your credibility intact.

• Align on expectations for transparency and timing

Be honest about what you can say and when. If you don’t have enough data to answer a question fully, say so. Then promise a precise timeframe for when you will have more information. For example: “We’re still investigating root causes; here’s what we know right now, and we’ll share a deeper update in 15 minutes.” Clear timelines reduce the risk of rumor and miscommunication.

• Post-incident, close the loop

After containment and recovery, schedule a debrief with the CEO and other executives. Share what happened, what was learned, how you’ll prevent recurrence, and the status of the system’s health. This isn’t a victory lap; it’s about trust and improvement. And yes, it helps shut down endless questions that might creep back in during the recovery phase.

Practical tools that bolster this approach

In the PagerDuty world, the incident response flow is designed to keep critical work focused while still delivering visibility to leadership. A few practical touches:

• Incident Commander role and workspace

The IC keeps the field in view while actions unfold. A dedicated space—whether it’s a command bridge in a conference room or a shared digital channel—helps the team stay aligned and respond with speed.

• A single-source-of-truth update

Whether it’s a live dashboard or a brief update doc, having one place where you record status, metrics, and next steps reduces miscommunication and avoids the “we told you something different earlier” trap.

• A liaison channel for executives

This isn’t a rumor mill. It’s a trusted channel where executives receive timely, curated updates. The liaison translates technical progress into business outcomes and keeps the CEO within a predictable information envelope.

• A post-incident review template

After the dust settles, a concise review helps answer lingering questions, explain root cause (without spoilers that overwhelm the business), and outline actions to harden the system.

Avoiding common missteps

• Don’t try to answer every question in real time

Some questions require data that isn’t yet ready. If you respond with guarded facts, you preserve credibility and avoid overpromising.

• Don’t let curiosity sprint out of control

Executives are curious. That’s not a sin. It’s a signal to keep remarks measured and timely. If you’re tempted to give the impression you know more than you do, pause, then circle back with the right data.

• Don’t neglect the human side

A crisis isn’t just about systems; it’s about people. A quick moment of empathy goes a long way. “I know this is frustrating. We’re focused on restoring service as fast as we can.” It humanizes the process and reinforces trust.

A few quick analogies to keep things relatable

• Think of the incident like a relay race. The IC takes the baton, runs the critical leg, and hands off to a teammate for the next phase. The CEO’s questions don’t disappear; they get a precise handoff later, not while the baton is in motion.

• Imagine the update as a weather forecast for the business. You give what’s known now, what’s changing, and when to expect the next forecast. No wild guesses, just clarity.

Why this approach matters beyond the moment

The principle—prioritize the incident, defer nonessential inquiries—structures trust. When leadership sees that you can maintain control under pressure, that you provide timely, honest updates, and that you follow up promptly, it builds a culture of reliability. In the long run, this reduces anxiety, accelerates resolution, and minimizes the ripple effects on customers, partners, and the bottom line.

A gentle reminder: training and readiness pay off

If you’re building teams that will handle these moments with poise, rehearsals help. Simulated scenarios, runbooks, and clear escalation paths aren’t luxuries; they are the backbone of calm under pressure. Organizations that practice these routines tend to bounce back faster, even when the ground shifts underfoot.

Closing thoughts: the confidence of leadership, earned in the fire

So, when a CEO asks a sharp question during a major incident, the right instinct isn’t to chase every detail. It’s to confirm the priority, commit to a quick, structured update path, and keep the core goal in view: restore service and minimize impact. It’s not about stifling curiosity—it’s about guiding the response with focus, transparency, and a plan that makes sense to people who matter.

If you’re building an incident response program, think of this approach as a compass. It points toward clarity, steadiness, and credible leadership when the pressure is highest. And if you want practical, real-world guidance on managing these moments in a PagerDuty-enabled workflow, start with the basics: a clear IC role, a trusted liaison, a tight update cadence, and a post-incident review that turns lessons into stronger defenses for next time.

One last thought—what will you do the next time a CEO looks your way in a crisis? Will you keep the focus crisp, or let the conversation wander into the weeds? The choice, in the heat, often determines not just the duration of the outage but the trust your organization carries forward.