Incident response doctrine does not usually cite a comedy about soccer, but stay with us. The BELIEVE sign is easy to mock: a yellow rectangle over a locker-room door. Watch two teams work the same outage, though, and the sign starts looking less like sentiment and more like strategy.
Two rooms, same outage
The pessimist room spirals early. Blame arrives before diagnosis. Options narrow, because proposing a fix that might fail feels dangerous in a room already assigning fault. People go quiet, protect themselves, and hold information close, which is the exact opposite of what diagnosis needs.
The optimist room runs differently: what can we try next, who can verify, keep the timeline, keep moving. Not because the people are smarter, but because the operating assumption, this is solvable, keeps the option tree open and the information flowing. Incident response is a team sport played under stress, and stress amplifies whatever culture you brought into the room.
We have sat in both rooms, sometimes with the same client a year apart. The difference in outcomes was never the vendor, the stack, or the monitoring budget. It was whether the first fifteen minutes produced a plan or a suspect.
Incident response optimism is discipline, not mood
Structured optimism has rules. Assume recoverability until proven otherwise, because most disasters are inconveniences that got compounded by panic decisions. Work in small reversible steps; despair loves a dramatic irreversible gesture. Keep a written timeline as you go, both for the fix and for the story afterward.
And postpone the blame conversation completely, then hold it blamelessly, because the goal of a retrospective is information for next time, and information dries up the moment it becomes evidence. None of this is soft. It is the same posture NIST’s incident response guidance formalizes: preparation, execution, lessons learned, with the emotion managed on purpose.
Practice is where belief comes from
Optimism you did not rehearse is just denial with better posture. The teams that stay calm at 3 a.m. are calm because they have restored from backup before, on a Tuesday, when nothing was wrong. Run tabletop exercises twice a year. Restore a real system from a real backup and time it; our backups and recovery page explains why an untested backup is a rumor.
Rotate who runs point during drills, so the plan survives vacations. Script the first three communications in advance: the internal alert, the client holding note, the all-clear. Words drafted calm read better than words drafted terrified, and customers remember the messaging longer than they remember the outage.
Do a paper drill on your worst case too: ransomware on a Friday, the owner unreachable, the backup server encrypted along with everything else. Walking that scenario in a conference room costs an hour. Meeting it live without a script costs a week, plus some percentage of your customers.
Confidence built this way is load-bearing. When the room knows the runbook works because they watched it work, believing becomes rational, and rational belief is the kind that keeps hands steady on keyboards.
Page zero of the runbook
Our incident response runbooks are technical from page one onward. But page zero, in effect, says: this is solvable, start the clock, be kind. Teams perform to that framing. Kindness under pressure is not decoration either; it is bandwidth. People who are not defending themselves have spare cycles for the actual problem, which is why we keep quoting Ted Lasso’s other rule: be curious, not judgmental.
Ted Lasso’s whole thesis is that relentless belief is a competitive strategy wearing a naive disguise, and after enough 3 a.m. bridge calls, we are convinced the show was right. Believe is not the plan. It is the condition under which people execute incident response plans well.
So put the sign up, metaphorically or literally. Then earn it: tested backups, written runbooks, rehearsed roles, blameless retros. Incident response without belief burns people out, and belief without incident response is just hope with a logo. You need both, and only one of them can be bought.
