A postmortem is a review held after an event to recognize what went well and learn what went wrong or could improve. It can follow a release or an operational failure. section 9.7.1 section 7.2.2
Judge decisions in context: what seems obvious after an incident may not have been clear beforehand. When a failure points to neglected planning, examine the responsible person’s actions and whether leadership decisions or missing authorization contributed. Document the event and consult the person responsible; repeated issues may call for better training or, as a last resort, a role change. section 7.2.2
Incidents worth examining include:
- A security breach linked to an uninstalled or outdated firewall. section 7.2.2
- Data loss after backups were not properly tested. section 7.2.2
- Service loss after a payment-problem email was missed, or hardware failure without an upgrade or continuity plan. section 7.2.2
