Incident postmortem

Incident scope

Local drill ID, snapshot, impact and authorized boundary. Distinguish observation from inference.

Timeline

Times of occurrence, detection, response and recovery; observations, actions and evidence.

Causes and evidence

Trigger conditions, contributing factors, failed assumptions and falsifiable diagnosis.

Improvements and verification

Role responsible for each action, checkpoints, generated fixes and regression verification. Keep the status awaiting verification until evidence is available.

Review

Time and roles of the human postmortem, existing evidence IDs and unresolved items. Record only activities that actually happened; do not submit a separate teaching-design form.