Reconstructs an incident without assigning blame and translates causes into concrete improvement actions.
Core question: Which conditions enabled the incident, and how do we reduce recurrence or impact?
Operating practiceMethod form: Operating practice. Describes how this method is used in practice.MediumComplexity: medium. Estimates preparation, facilitation effort, and method confidence needed.Workshop + asyncFormat: workshop or async. Shows whether the method works in a workshop, asynchronously, or both.
30-90 min
3-12
Details
DevOpsCategory: DevOps. Describes the method's domain of use.
Coordinates roles, communication, and measures during an incident so situational awareness and decisions converge.
Core question: Who commands, who works the technical problem, and how do we maintain a shared situation?
Operating practiceMethod form: Operating practice. Describes how this method is used in practice.MediumComplexity: medium. Estimates preparation, facilitation effort, and method confidence needed.Workshop + asyncFormat: workshop or async. Shows whether the method works in a workshop, asynchronously, or both.
As needed
4-15
Details
OperationsCategory: Operations. Describes the method's domain of use.
Describes a recurring scenario with steps, checks, and escalation so execution stays stable under pressure.
Core question: Can an authorized responder under pressure safely tell when and how to use this procedure?
Operating practiceMethod form: Operating practice. Describes how this method is used in practice.LowComplexity: low. Estimates preparation, facilitation effort, and method confidence needed.AsyncFormat: async. Shows whether the method works in a workshop, asynchronously, or both.