Post-mortem template exists
Why it matters
Without a post-mortem template, email incidents end when sends resume — the root cause, contributing factors, and action items are never formally captured. The same misconfiguration repeats. NIST SP 800-53 IR-5 (Incident Monitoring) and ISO 25010 reliability.recoverability both require that incidents are tracked and that learnings feed back into system improvements. A template is not bureaucracy — it is the mechanism that converts a painful incident into a concrete backlog item that prevents recurrence.
Severity rationale
Low because missing post-mortems cause recurring incidents rather than immediate failures — the impact accumulates over months as the same root causes repeat without structural fixes.
Remediation
Create docs/templates/post-mortem.md with at least five sections:
# Incident Post-Mortem
**Date:** YYYY-MM-DD
**Severity:** P1 / P2 / P3
**Duration:** HH:MM (detection to resolution)
**Affected:** [N emails affected] [N contacts impacted]
## Timeline
- HH:MM — [event]
## Root Cause
[One paragraph]
## Contributing Factors
- [Factor]
## What Worked
- [Item]
## What Didn't Work
- [Item]
## Action Items
| Action | Owner | Due |
|--------|-------|-----|
| | | |
Reference this template from the deliverability incident runbook (docs/runbooks/deliverability-incident.md) so it is findable after every incident. A template with fewer than 5 sections does not satisfy this check.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Operational Resilience (Email) Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- iso-25010:2011 · reliability.recoverability — Reliability / Recoverability — post-mortem template drives continuous improvement after email incidents
- nist:rev5 · IR-5 — NIST 800-53 IR-5: Incident Monitoring and Reporting
Taxons
History
- 2026-04-18·v1.0.0·Initial import from operational-resilience-email·automated