Incident Report (IT)
Structure of an IT incident report
Summary
[edit]This section briefly describes the incident, including when it happened, when it was resolved and its impact. It also summarizes the problem that was the root cause of the incident, such as the number of requests that resulted in errors.
Timeline
[edit]This section identifies the precise times of all related events, including the time zone if relevant. These events should include the first report of the incident, all actions taken to resolve the issue and consequent events, and the time that the incident was resolved.
Root cause
[edit]This section describes the problem that caused the incident in as much detail as possible.
Resolution and recovery
[edit]This section describes in detail all actions taken to resolve and recover from the incident, along with when they were implemented. Any results of actions taken should also be described, even if the measures were not effective.
Corrective and preventive measures
[edit]This section discusses what measures should be taken to prevent a similar incident in the future, including any recommended changes to systems or procedures. The section should also include any recommended improvements to the organization's incident response system.