The First 60 Minutes of an Outage: What to Do

Your POS system is down. Or your email stopped working. Or your website is showing an error page.

It doesn't matter what failed. What matters is the next 60 minutes.

Most SMBs either underreact (wait and see if it fixes itself) or overreact (call everyone, change everything, make things worse). Neither works.

Here's what actually helps.

What this solves

Stops the clock on business impact. Every minute something is down, your business is losing money or customers.

Prevents bad fixes. Panicked changes during an outage often create new problems.

Gets the right people involved. Not everyone needs to know immediately, but the right people need to know quickly.

Creates documentation for the fix and the postmortem. You'll need this later.

What can go wrong

Alerting everyone. Thirty people texting the IT person doesn't speed up the fix. It slows everyone down.

Making changes without documenting. Something gets fixed, but nobody knows what the actual problem was or how it got resolved.

Assuming it's already being handled. Someone else reported it. Someone else is working on it. Meanwhile, nobody is working on it.

Not communicating with customers. Even a 15-minute delay in telling customers you're aware of an issue turns a minor outage into a PR problem.

Going it alone when you need help. Pride keeps businesses down longer than any technical problem.

What it costs (honest ranges)

Downtime costs for common SMB systems:

• POS system: $500-$5,000 per hour depending on business volume
• Email: $50-$200 per hour in lost productivity
• Website: $200-$2,000 per hour depending on e-commerce volume
• ERP/database: $1,000-$10,000 per hour for manufacturing or logistics

Emergency IT support: $150-$350 per hour for after-hours emergency support. Higher than normal rates, but cheaper than extended downtime.

MSP after-hours SLA: $500-$2,000 per incident if you have a managed services contract with emergency support.

First 60 minutes

Minutes 0-5: Acknowledge and assess

• Confirm the outage is real. Check monitoring tools. Check if multiple systems are affected.
• Assign an incident commander. One person owns this incident, makes calls, coordinates.
• Send initial status update to stakeholders. You don't need answers yet. They need to know you're aware.

Minutes 5-15: Scope the impact

• What systems are affected? One system, or multiple?
• How many users/customers impacted? Just internal, or external customers too?
• Is this getting worse, or is it stable? Check if errors are increasing.

Minutes 15-30: Start diagnosis

• What changed recently? Software updates, configuration changes, new integrations?
• Check logs. Server logs, application logs, firewall logs, DNS checks.
• Can you isolate the problem? If one system is causing issues, can you shut it down to protect the rest?

Minutes 30-45: Execute fix or workaround

• If you've identified the problem, fix it. If you haven't, apply the most likely fix and monitor.
• If a fix isn't ready, implement a workaround. Can customers place orders manually? Can you route around the broken system?
• Document everything you're trying. You need this for the postmortem.

Minutes 45-60: Verify and communicate

• Confirm the outage is resolved. Test the fix. Check that dependent systems are working.
• Send update to stakeholders. Tell them the issue is resolved, or tell them an ETA if it's not.
• Document the incident timeline. What time did it start? What time did you find out? What did you try? What worked?

Vendor questions (copy/paste)

Ask your IT vendor or MSP before an outage:

• What's your emergency contact number for after-hours issues?
• What's your expected response time for critical outages?
• Do you have a documented incident response process?
• Who has access to our systems to respond, and what's the authentication method?
• Can you provide examples of recent incidents you've resolved?

When to hire help

You've been down for more than 30 minutes without a clear path to resolution. Stop guessing.

The problem is spreading. New systems are failing. Something bigger is happening.

You don't have monitoring. You don't know what broke or why. Get someone who can diagnose quickly.

It's a security incident. Suspected breach, ransomware, or unauthorized access requires specialized help immediately.

---

The first hour isn't about finding the perfect fix. It's about containing the damage, communicating with stakeholders, and setting up for a faster resolution. Everything else comes after.