Incident memo template

• Attach the memo to incident tickets, postmortems, and audit logs.
• Publish a redacted version if external transparency is required.
• Link to mechanism evidence and diagnostics outputs for remediation.

Incident memo (Template)

1) Executive summary
- One-paragraph summary of the incident and outcome.
- Date(s) and affected systems.
- Primary impact on people, partners, or operations.

2) Timeline (UTC)
- T0: Trigger detected (signal/alert/source).
- T1: Triage decision + owner.
- T2: Mitigation steps deployed.
- T3: Incident resolved or stabilized.

3) Impact summary
- Who was impacted, how, and for how long.
- Scope metrics (counts, regions, cohorts).
- Residual harm or unresolved exposure.

4) Root cause + contributing factors
- Primary failure mode.
- Contributing governance gaps.
- Missing safeguards or controls.

5) Governance breakdowns
- Decision or escalation failures.
- Missing accountability artifacts.
- Policy or mechanism gaps.

6) Remediation plan
- Immediate fixes (with owners + due dates).
- Medium-term prevention work.
- Long-term governance upgrades.

7) Evidence + artifacts
- Links to decision logs, validator outputs, receipts.
- Incident-specific data snapshots and charts.
- Audit-ready documentation references.

8) Follow-up commitments
- Next review date.
- Owner for validation.
- Comms or transparency commitments.