Postmortems

Postmortems turn incident evidence into shared learning and follow-up work. They should preserve links to the source timeline rather than restating it manually.

A postmortem connects impact, contributing conditions, detection, response, and resolution to the immutable incident record. Draft and review state let teams separate investigation from publication. Action items carry an owner and tracked status so learning produces accountable change.

Write for system improvement rather than individual blame. Link evidence, distinguish observed facts from hypotheses, and close action items only when the remediation is verifiably complete.