# Blameless incident postmortem template

Build this review from the incident record and preserved evidence. Explain system conditions and decision context without assigning personal blame.

## Incident facts

- Incident reference:
- Title:
- Severity and rationale:
- Status:
- Impact start:
- Detection time:
- Recovery time:
- Duration:
- Affected services:
- Affected regions:
- Customer impact:
- Incident lead:
- Review owner:

## Executive summary

What happened, who or what was affected, how long impact lasted, and how the team restored service.

## Impact

- Customer experience:
- Scope and affected segments:
- Business or operational effect:
- How impact was measured:
- Important uncertainty or missing data:

## Detection and response

- How was the issue detected?
- What made detection effective or ineffective?
- How were responders engaged?
- Which actions changed the trajectory of the incident?
- How was recovery verified?

## Timeline

Link the reviewed incident timeline or include the important events here.

| Time | Event | Owner | Evidence |
| --- | --- | --- | --- |
|  |  |  |  |

## Trigger and contributing conditions

### Trigger

The initiating change or event supported by evidence.

### Contributing technical conditions

- Condition:
- Evidence:
- Why existing controls did not prevent or contain it:

### Contributing organizational conditions

- Condition:
- Decision context:
- Constraint or tradeoff:

## Defense analysis

- Prevention gaps:
- Detection gaps:
- Containment gaps:
- Communication gaps:
- Recovery gaps:

## What helped

- Effective tools, controls, runbooks, signals, or coordination patterns:

## What made response harder

- Missing context, noisy signals, unclear ownership, unsafe defaults, or process friction:

## Corrective actions

Every action should name the risk reduced and include evidence of completion.

| Action | Risk reduced | Owner | Due date | Verification |
| --- | --- | --- | --- | --- |
|  |  |  |  |  |

## Evidence quality and open questions

- Sources reviewed:
- Gaps in evidence:
- Disputed facts:
- Confidence in causal claims:
- Questions that remain open:

## Review record

- [ ] Incident responders reviewed the chronology.
- [ ] Customer impact was reviewed by the appropriate owner.
- [ ] Corrective actions have owners and due dates.
- [ ] Unresolved disagreement is documented.
- [ ] A follow-up date is scheduled to verify completed actions.