Write a Postmortem

When writing an incident postmortem:

1. Summary: one paragraph describing what happened, who was affected, and how long it lasted.
2. Timeline: chronological list of events from detection to resolution with timestamps.
3. Root cause: what specifically caused the incident. Be precise — “a bug” is not a root cause.
4. Impact: quantify the impact — number of users affected, duration, data affected, revenue lost.
5. What went well: what helped detect, respond to, or resolve the incident quickly.
6. What went wrong: what delayed detection or resolution. Be blameless — focus on systems, not people.
7. Action items: concrete, assigned, and time-bound steps to prevent recurrence. Each item should have an owner and a deadline.