Declare an incident first, investigate later.
Cheating SLAs by delaying the incident is a good way to erode trust within and without.
If that would be the best way to deal with it- why is literally no one doing it this way and what does that tell you?
Declare an incident first, investigate later.
Cheating SLAs by delaying the incident is a good way to erode trust within and without.