The incident has happened and you've decided to write a postmortem document. You have done your analysis. What do you put in it? My rough template tends to be as follows—summary, impact, timeline, root cause, action items, and appendix. As long as you capture the incident in detail, you can put whatever you want in a postmortem document. I usually aim for a few pages, but depending on how complicated the outage was, it may be as short as one or two pages or as long as 20. The following is the template I usually use as a starting point to help me to organize my thoughts. Staring at a template after (or during) analysis is a helpful framework compared to just looking at a blank page and debating what to write. There are many other templates available online and one repository of templates is at https://github.com/dastergon/postmortem-templates.
At the top of the document, add the names of those involved, the date of the incident and when the document was last...