post-incident-review

A blameless post-incident review guides a no-fault retrospective focused on systems and processes. It reconstructs the incident timeline, applies structured root cause analysis, and calculates metrics like MTTD, MTTC, and MTTR to generate trackable remediation actions.

Calculating MTTD, MTTC, and MTTR during incident closeout involves mapping the incident timeline to detection, containment, and recovery phases. These metrics are then mapped against preventive, detective, and corrective control gaps to identify measurable improvements.

Mapping control failures to remediation actions requires analyzing the incident sequence to identify preventive, detective, and corrective control gaps. The review process translates these gaps into prioritized action items and schedules follow-up remediation reviews.

NIST SP 800-61 Rev 2 provides the framework for structuring post-incident activity. It supports blameless retrospectives by enforcing timeline reconstruction, root cause analysis, and control failure mapping while preventing the exfiltration of sensitive incident data.

A post-incident report schema for root cause analysis includes the reconstructed incident timeline, structured root cause findings using techniques like 5 Whys, calculated MTTD and MTTR metrics, and a prioritized remediation plan with follow-up schedules.