What to do once the site is back.
WRITE IT DOWN WHILE IT IS FRESH
What happened When it was noticed, and how What the cause was What you did How long it took What was lost
Within a day. A week later the detail is gone.
THE QUESTIONS
Could it have been prevented Was it noticed quickly enough Were the backups adequate Did the restore work as expected Was the documentation accurate Did communication work
WHAT USUALLY COMES OUT
Backups less complete than assumed Retention too short Nobody monitoring, so it was noticed late Documentation out of date A step in the restore that was harder than expected
ACTING ON IT
Pick the two most important improvements and make them now, while the incident is recent enough to motivate it.
A list of twelve improvements produces none.
TELLING PEOPLE
If clients or colleagues were affected, a short honest account of what happened and what changed is worth more than reassurance.
THE POINT
An incident that produces no change will happen again.
