POST-INCIDENT REVIEW ==================== [Organization name] Incident: [short name] Dates: [from] to [to] Review held on: [date] Facilitator: [name] Notes by: [name] People present: [names and roles] How to use this template: fill it in during the review or straight after it, and keep it to one page. Describe what happened and what will change, not who was at fault. Take the timeline from your incident log. Guide: https://moraph.org/commons/incident-review 1. What happened ---------------- Two or three sentences: what happened, when it was noticed, and how it ended. [...] 2. Timeline ----------- The main moments, oldest first, taken from the incident log. When | What happened | What we did -----+---------------+------------ | | | | | | 3. Impact --------- What was affected: systems, money, people, services, information. Say what is still unknown. [...] 4. What helped -------------- The things that worked and should be kept. [...] 5. What got in the way ---------------------- Missing information, tools, access, contacts or decisions, and unclear steps. [...] 6. What we will change ---------------------- Three to five actions, each with one owner and a date. # | Action | Owner | Due by | Done --+--------+-------+--------+----- 1 | | | | 2 | | | | 3 | | | | 4 | | | | 5 | | | | 7. Updates to our plan and self-assessment ------------------------------------------ What changes in the incident plan, and which self-assessment answers change. [...] 8. What we will share, and with whom ------------------------------------ What staff, the board and anyone else will be told, and by whom. [...] Next check on the actions: [date] Checked by: [name] ------------------------------------------------------------ Template by Moraph for Good (https://moraph.org/commons/incident-review). Free to copy and adapt under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Attribution: "Moraph for Good".