Incident Post-Mortem Generator

Incident Identity

Title One-line summary (what happened, in plain language)

Impact

Regulatory notification triggered? None GDPR Article 33 (within 72h) HIPAA Breach Notification State breach notification law(s) SEC 8-K (material cybersecurity) Multiple — specify in narrative

Timeline

+ Add timeline event

Detection & Response

How was it detected? (alert / user report / proactive hunt / external notification) What was the first response action and who took it? What containment / eradication / recovery actions ran?

Root Cause Analysis (5 Whys)

Frame each step as a system question, not a person question. Stop when the answer is "a system gap that we can fix," not "a person who was wrong."

Why 1 — Why did this incident happen? Why 2 — Why was that condition true? Why 3 — Why was THAT condition true? Why 4 — (optional) Why was that the case? Why 5 — (optional) The systemic root cause

Contributing Factors

Things that made this worse than it had to be. Tooling gaps, missing playbooks, org-structure issues, vendor failures.

+ Add contributing factor

What Went Well / What Went Wrong

What went well (be specific — name the system, the team, the artifact) What went wrong (system gaps — never people)

Action Items

Each item: owner, due date, priority. No item without an owner. No item without a date.

+ Add action item

Lessons Learned

What does this teach us about the program (not just this incident)?

Live Markdown Preview