rca

A blameless postmortem identifies and documents root causes of security incidents without assigning blame, using a structured RCA framework to produce formal lessons and corrective actions. It applies Ishikawa analysis and fault-tree diagrams to uncover systemic issues.

Root cause analysis requires a step-by-step timeline driven by incident data and log sources to ensure evidence traceability and reproduce findings. This timeline provides the formal structure needed to isolate systemic failures and prescribe concrete corrective actions with owners and due dates.

Ishikawa and fault-tree analysis are applied together within the blameless RCA framework to investigate outages and near-misses. This combined approach enables barrier analysis and identifies systemic root causes, resulting in formal RCA documents and actionable lessons learned.

A formal RCA document with corrective actions is needed after a Severity High incident, security breach, or policy violation to ensure durable remediation. It satisfies requirements for step-by-step timelines, Ishikawa analysis, and fault-tree diagrams to prevent recurrence.

Root cause analysis works for near-misses, Keeper Tests, and policy violations by applying the same blameless postmortem framework used for security incidents and outages. It generates a formal RCA, LESSONS row, and constitutional amendments when systemic issues are found.