This walkthrough needs JavaScript. In short: an incident management platform, as this practice designs it, keeps the path that wakes a person (the paging path) separate from the incident record (the control plane). Three paging cells, one outside the estate, page from a replicated copy of who is on call, so a page still goes out with the console, the incident store, the identity provider and both estate data centres gone. Only an acknowledgement ends an escalation, on-call time is worked out 72 hours ahead and checked by a second resolver, duplicates are preferred to misses, and every suppression is declared by a person with an expiry.