Postmortem template — Markdown, ready to paste

This is the exact skeleton our generator fills in — the structure kept simple enough that engineers finish it, strict enough that reviewers trust it. Copy it, or let the generator fill it from your raw timeline automatically.

# <Incident title>

- **Date:** YYYY-MM-DD
- **Severity:** SEV-<n> (see severity ladder)
- **Duration:** <detect → mitigate → resolve>, UTC
- **Services affected:** <list>
- **Author:** <name> · **Reviewers:** <list> · **Status:** Draft | Reviewed

## Executive summary
Three to five sentences: what broke, customer-visible impact in plain numbers, how it was fixed, current confidence in root cause. Written last, read first.

## Impact
- Users affected: <count or % of traffic>
- Business impact: <revenue, SLA/SLO breach, support volume>
- Data loss / corruption: none | <details>

## Timeline
| Time (UTC) | Event | Source |
| --- | --- | --- |
| 02:14 | Deploy of orders-api v41 starts | CI/CD |
| 02:19 | Error-rate alert fires | Grafana |
| 02:23 | On-call acknowledges | PagerDuty |
| 02:31 | Rollback complete, errors stop | Deploys |

## Root cause (5 Whys)
1. Why? …
2. Why did that condition exist? …
3. Why wasn't it caught earlier? …
4. Why didn't alerting prevent impact? …
5. Why does no systemic guardrail exist yet? …

**Root cause (one sentence):** …

## Detection
How was it found? Alert vs customer report. MTTD: <time>. What would have caught it faster?

## Resolution & recovery
Mitigation steps taken. MTTR: <time>. What is left in a degraded state?

## What went well
- Honest bullets

## What went poorly
- Honest bullets — systems and process, never people

## Where we got lucky
- Near-misses worth writing down

## Action items
| Action | Type | Owner | Priority |
| --- | --- | --- | --- |
| Regression test for failure mode | Prevent | @owner | P0 |
| Alert on leading indicator | Detect | @owner | P0 |
| Runbook for manual mitigation | Mitigate | @owner | P1 |

Every action item has an owner and a due date. Untyped items get deleted.

Usage notes

• The metadata block enables greppability across dozens of docs later.
• TODO markers are features: they convert unknowns into assigned follow-ups instead of confidently wrong text.
• Action item typing (prevent/detect/mitigate) keeps portfolios balanced — a quarter of pure "prevent" items means detection debt is accumulating unseen.

Want it generated from your incident notes instead? Paste your timeline here.

Related reading

• How to Write a Postmortem That Actually Gets Read (2026 Guide)
• What Is a Blameless Postmortem? Principles & Anti-Patterns
• The 5 Whys Method for Incident Root Cause Analysis (With Examples)
• SEV Levels Explained: SEV-1 to SEV-4 With Real Examples
• Postmortem Review Meeting Agenda (30-Minute Format)