Establish the record
Give readers the incident facts before asking them to interpret causes.
Summary and impact
State what happened, the affected services and regions, customer experience, duration, and how impact was measured.
Detection and response
Explain how the incident was detected, how responders were engaged, and the major mitigation and recovery milestones.
Evidence quality
List the sources used, important gaps, disputed facts, and confidence in timing or causal claims.
Analyze conditions without blame
Explain why the system and response behaved as they did in the context available at the time.
Trigger and contributing conditions
Separate the initiating change or event from the technical and organizational conditions that allowed impact to develop.
Defense gaps
Identify which prevention, detection, containment, communication, or recovery controls were missing or ineffective.
Decision context
Describe the information responders had, the constraints they faced, and why their actions were locally reasonable.
Turn learning into change
Prefer a small number of specific risk-reduction actions over a long wish list.
Corrective action
State the risk reduced, the concrete deliverable, the owner, the due date, and how completion will be verified.
Follow-up evidence
Link the issue, change, test, dashboard, or runbook update that proves the action was completed.
Review the review
Record unresolved disagreement and schedule a later check on whether the actions changed detection, containment, or recovery behavior.