Identify the event, affected service/project and discovery time. Distinguish observed facts from suspected causes.
,Record immediate containment, responsible owners and preserved evidence. Keep credentials, private download links and unnecessary personal details out of the incident summary.
,Track actual recovery checks and follow-up separately from plans. A green status or restarted process is not proof that every affected user journey has recovered.
The incident record draft will organise your answers, including your project, record or worksheet reference and responsible recorder and record date. It will identify missing entries; completion does not independently verify the stated claim or outcome.
