Templates
Postmortem Template
Postmortems should explain how the system failed and what will change. They are not blame documents and they are not theater.
Template
# Postmortem: Incident title
## Summary
Briefly describe what happened, who was affected, and current status.
## Impact
- Start time:
- End time:
- Duration:
- Affected users or systems:
- Customer, data, compliance, or financial impact:
## Timeline
| Time | Event |
| ---- | ---------- |
| | Detection |
| | Triage |
| | Mitigation |
| | Recovery |
## Root causes and contributing factors
What conditions allowed the incident to happen or last longer?
## What went well
What helped detection, response, or recovery?
## What went poorly
What slowed detection, response, or recovery?
## Action items
| Action | Owner | Due date | Priority |
| ------ | ----- | -------- | -------- |
| | | | |
## Follow-up review
When will action items be reviewed?Action item rules
Action items should be specific, owned, and tied to incident learning. Avoid vague items like "improve monitoring". Use concrete items like "alert on queue age above five minutes for checkout events".