Why Ops Teams Should Write Runbooks During Incidents, Not After

Software engineer Serguey Shinder argues that operations teams must document critical procedures in runbooks before an emergency strikes, not after. He draws on a personal experience where a Saturday outage lasted six hours because the only person who understood certificate rotation was unreachable, leaving colleagues to guess and worsen the situation. Shinder recommends writing runbooks immediately after an incident, while exact commands and context are still fresh, and treating documentation as part of closing the incident rather than a deferred task. A useful runbook, he notes, should define what success looks like at each step and provide a clear fallback if something goes wrong. His core principle is that no single team member should be a single point of failure in any critical operational process.