Include a timeline
- Input - when the bug(s) reached production
- Detection - when the incident was detected. It initiates the incident management process (e.g. SLA for incident resolution starts).
- Resolution - when the incident was resolved (e.g. through a workaround, final fix, rollback, etc). This is the end of incident management (e.g. SLA for incident resolution ends)
Explanation of how customers were affected
List anything you did well and want to call out. IT’s OK to not list anything.
What can be done to prevent this kind of incident from happening again?
What can be done to detect the incident earlier / faster / more reliably
What can be done to improve our mitigation time?
Describe what was agreed to do. For each action create an issue in the team’s backlog and link them to this postmortem.
- Any fixes required to prevent the contributing factor in the future
- Any preparedness tasks that could help mitigate the problem if it came up again
- Remaining postmortem steps, such as internal communications, status-page public post, …
- Any improvements to our incident response process
Sources