Post-Incident Review Template
A blameless post-incident review: evidenced UTC timeline, what went well and badly, root cause and contributing factors, an actions tracker with owners and due dates, time to detect, contain and resolve, and sign-off.
Template & sample only — a structured starting point with sample content, not legal, audit, certification or investment advice.Customise it with your own details for free; exporting the generated document is part of Pro.
A blameless post-incident review: an evidenced UTC timeline, what went well and badly, root cause and contributing factors, an actions tracker with owners, due dates and status, and sign-off. Enter the key times in the profile to get time to detect, time to contain and time to resolve; averaged across incidents these become your MTTD and MTTR. The summary also shows actions done and overdue.
Your context
Timeline
Facts only, in UTC, each with the source that shows it. Include when people found out and decided, not just what the attacker did.
Review
Blameless: describe what the system, process and tools allowed, not who failed. People acted on the information they had at the time.
Actions and lessons tracker
Every action has one owner, a due date (YYYY-MM-DD) and a status. Track to completion, not to agreement.
Review quality check
Before sign-off, check the review itself.
The review is blameless: no individual is named as the cause, and findings describe conditions, not charactermaterial
Every timeline entry has a source, and times are in UTC
Everyone involved was invited, including finance, legal, communications and any supplier
The review was held within two weeks of closing the incident
Each root cause and contributing factor has at least one action, or a recorded decision to accept the riskmaterial
Every action has a single named owner and a due date
At least one action improves detection, not only prevention
Changes needed to the incident response plan, playbooks or contact lists are captured as actions
Lessons are shared beyond the team (a short summary to leadership and relevant staff)
Sign-off
What this template gives you
- A post-incident review is only worth the actions that get finished. The tracker records one owner, a due date and completion evidence for each, and flags overdue actions.
- Enter four times (first malicious activity, detected, contained, resolved) and the template works out time to detect, time to contain and time to resolve. Averaged across incidents, these are your MTTD and MTTR.
- Blameless by design: findings describe what the process and tools allowed, not who failed.
- The sample is a business email compromise with a redirected supplier payment, so you can see a finished review before writing your own.
Frequently asked questions
What should a post-incident review include?
A factual timeline with sources, what went well and what went badly, the root cause and contributing factors, the notification and communication decisions taken, a list of actions with owners and dates, the key response times, and sign-off. NIST SP 800-61 treats lessons learned as part of the incident response life cycle, feeding improvements back into preparation.
What does blameless mean in a post-incident review?
It means the review looks for the conditions that made a mistake possible, such as a process that allowed a bank-detail change on email alone, instead of naming a person as the cause. People share more when they are not afraid of blame, and fixing conditions prevents the next incident; blaming a person does not.
How do you calculate MTTD and MTTR?
For each incident, time to detect is detection time minus the time of the first malicious activity, and time to resolve is resolution time minus detection time. MTTD and MTTR are the averages (or better, medians) across incidents over a period. Record the times in UTC from evidence, not memory.
Is this a finished document I can rely on?
No. Every tool in this suite is a template with sample content. It gives you a structured, editable starting point and generates a document from your own answers, but it is not legal, audit, certification, investment or professional advice. Review and adapt the output, and have it checked by the appropriate specialist before you rely on it.
Who can use it?
Anyone. Using it and customising it with your own details is free, and your work is saved in your own browser. Exporting the generated document (Word, PDF, Markdown, CSV) is part of any PlayCISO paid plan.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.