Incident Summary

Write a summary of the incident in a few sentences.

Lead up

Describe the sequence of events that led to the incident.

Detection

When did the team detect the incident? How did they know it was happening? How could we improve time-to-detection? Consider: How would we have cut that time by half?

Impact

Describe how the incident impacted internal and external users during the incident. Include how many support cases were raised.

Response

Who responded to the incident? When did they respond, and what did they do? Note any delays or obstacles to responding.

Recovery

Describe how the service was restored and the incident was deemed over.

Timeline

Detail the incident timeline. We recommend using UTC to standardize for timezones.

Root Cause

The Five Whys

Backlog Check

Review your engineering backlog to find out if there was any unplanned work there that could have prevented this incident, or at least reduced its impact?

Lessons Learned

Discuss what went well in the incident response, what could have been improved, and where there are opportunities for improvement.

Corrective Actions

Describe the corrective action ordered to prevent this class of incident in the future. Note who is responsible and when they have to complete the work and where that work is being tracked.