Incident Postmortem: [Incident title]

Field	Value
Incident ID	[Reference]
Severity	[Level using your team’s definitions]
Status	Draft / In review / Final
Incident lead	[Name]
Review owner	[Name]
Start / end	[Timestamps with timezone]
Affected systems	[Services and regions]
Related links	[Incident channel, dashboards, tickets]

Summary

[State what happened, the user-visible effect, how service was restored, and the current state. Separate verified facts from hypotheses.]

Customer and business impact

• Affected users or tenants: [Count or estimate, with source.]
• Affected operations: [Failed, delayed, or degraded workflows.]
• Duration: [Impact window, distinct from investigation duration.]
• Data impact: [Confirmed loss, corruption, exposure, or no evidence found; state remaining uncertainty.]
• Communication: [Who was notified, when, and where.]

Timeline

Use one timezone throughout: [UTC or named timezone].

Time	Event or observation	Action and result	Evidence
[Timestamp]	[First known impact]	[Action, if any]	[Logs or metrics]
[Timestamp]	[Detection or report]	[Triage started]	[Alert or ticket]
[Timestamp]	[Mitigation attempted]	[Observed result]	[Deployment or command record]
[Timestamp]	[Service restored]	[Recovery verified]	[Health checks]

Detection and response

How we detected it: [Alert, support report, or manual observation.]

Detection gaps: [Why earlier signals did not lead to action.]

Response constraints: [Access, documentation, tooling, or coordination issues.]

Causes and contributing factors

Factor	Supporting evidence	Role in the incident
[Trigger]	[Verified evidence]	[How impact began]
[System condition]	[Verified evidence]	[How impact spread or persisted]
[Process condition]	[Verified evidence]	[Why safeguards did not catch it]

Unresolved hypotheses: [What remains unknown and how it will be investigated.]

Recovery and validation

[Describe the mitigation, why it worked, how recovery was verified, and any temporary measures still in place.]

What worked and what needs improvement

• Worked well: [Effective safeguard or response practice.]
• Needs improvement: [Specific system or process gap.]

Follow-up actions

ID	Action	Type	Owner	Due date	Verification	Tracking link
A-01	[Reduce likelihood of recurrence]	Prevention	[Name]	[Date]	[Test or observable outcome]	[Issue]
A-02	[Improve detection or recovery]	Detection / mitigation	[Name]	[Date]	[Exercise or measurement]	[Issue]

Review and closure

• Impact and timeline reviewed by responders.
• Follow-up actions have owners and tracking links.
• Temporary mitigations have an expiry or removal plan.
• Customer communication is complete where needed.
• Action review scheduled for [date].