I was a Staff SRE at Google in 2013 when I built their incident management system, IMAG. The second edition of Google & O'Reilly's SRE Book just came out, and its overhauled incident management chapter is a solid 40-page survey of how Google handles incidents today. I'm proud that Google is still using and evolving IMAG; I've heard that they're now up to version 5.
So how did IMAG (simply "Incident Management at Google"; admittedly, not my most inspired naming work) come to be? It grew out of a pattern I noticed in post-incident reviews ("postmortems", in Google lingo): incidents, especially those spanning multiple teams, were often slow and messy because responders had no common structure for coordinating and communicating.
From my experience as a search and rescue pilot and air search incident commander, I knew that fire departments and other public safety agencies had confronted these same problems decades before and had developed the Incident Command System (ICS) to address them.
I made the case to my VP, Ben Lutch, that we should adapt ICS to Google's needs and circumstances. He agreed, and I spent the next couple of years doing exactly that, building a training curriculum, and teaching it to teams across the company and around the world. The result: when an incident hit, everyone was ready to work together.
Congratulations to the authors of the new SRE Book's incident management chapter: Dan Dennison, David Huska, Garrett Plasky, Jennifer Mace, Michelle Brush, Garrett Holthaus, and Nick Bitzer.
I'm nearly finished writing my own book, Incident Management for DevOps and SRE, on track for publication in early 2027. It's shaping up to be over 800 pages, capturing my decades of experience in incident management and showing how to apply it in companies large and small. Sign up for updates at im4ds.com.
