Incident

Asks its way step by step to a controllable cause and stops only once an effective countermeasure is within reach.

Core question: Which controllable cause behind the symptom can the team fix with a concrete countermeasure?

• 15-30 min
• 2-6

Reconstructs an incident without assigning blame and translates causes into concrete improvement actions.

Core question: Which conditions enabled the incident, and how do we reduce recurrence or impact?

• 30-90 min
• 3-12

Coordinates roles, communication, and measures during an incident so situational awareness and decisions converge.

Core question: Who commands, who works the technical problem, and how do we maintain a shared situation?

• As needed
• 4-15

Moves incident response into a shared thread, connects alerts with commands, and keeps decisions traceable.

Core question: Which operational action benefits from shared visibility, and what controls prevent misuse?

• Ongoing
• 2-20

Simulates realistic incident scenarios, exposes gaps in response and runbooks, and improves preparedness.

Core question: Can the system and response team safely detect and handle this bounded failure scenario?

• Halber Tag
• 5-20

Clarifies workflows, data, causes, and improvements by framing the problem precisely, branching possible causes, and defining countermeasures.

Core question: Which evidenced conditions explain the problem and which can we usefully change?

• 1-3 h
• 2-8

Examines an incident with a view to decisions, assumptions, and system factors, and records the resulting lessons.

Core question: What can we learn from the actual course of events without reducing the analysis to individual blame?

• 1-3 h
• 3-10

Separates events, evidence, confirmed causes, and fitting actions so analysis does not turn into blame-finding.

Core question: Which evidenced system causes must change so this or a similar event does not recur?

• 1-4 h
• 3-8

Reconstructs a chain of events, marks factors, and derives verifiable causes and corrective actions.

Core question: Which events and conditions demonstrably contributed to the undesired outcome, and how are they linked in time and causality?

• 2-6 h
• 3-10

Arranges events, decisions, and delays chronologically and makes causes and lessons learned visible.

Core question: Which evidenced event sequence explains detection, response, and impact without projecting later knowledge into earlier decisions?

• 60-180 min
• 3-10

A structured accident tree separates management controls, barriers, and events so serious incidents become auditable.

Core question: Which barrier, task, and management factors enabled or failed to prevent the event?

• Mehrere Tage bis Wochen
• 2-6

Hazards, targets, and failed barriers are mapped so controls can be strengthened at the point of exposure.

Core question: Which barrier should interrupt the path, how did it fail, and which independent control is missing?

• 2-4 h
• 2-6

A recurring incident pattern links related cases across time so systemic causes become visible beyond one event.

Core question: Which recurring condition connects related events, and which systemic action is missing?

• 2-4 h
• 2-6