Postmortem Template for Cybersecurity Incidents
Cybersecurity postmortems differ fundamentally from operational postmortems because they involve adversarial actors, regulatory notification requirements, and forensic evidence that must be preserved. The blameless approach still applies internally, but external communication must be coordinated with legal counsel.
This template addresses the unique requirements of security incident postmortems, including evidence chain of custody and regulatory response timelines.
Template sections
5 sections covering the complete postmortem workflow.
Attack Vector Analysis
Document the complete attack path: initial access method (phishing, vulnerability exploitation, credential compromise), lateral movement steps, privilege escalation techniques, data accessed or exfiltrated, and persistence mechanisms. Map to MITRE ATT&CK techniques for standardized classification.
Forensic Evidence Chain
Document all evidence collected, preservation methods, and chain of custody. Include: log sources collected, memory dumps taken, disk images created, network captures preserved, and which forensic tools were used. This documentation may be required for legal proceedings or regulatory investigations.
Regulatory Notification Assessment
Evaluate notification requirements based on the data involved: GDPR (72-hour notification to supervisory authority), CCPA (notification to affected California residents), HIPAA (60-day notification for healthcare data), SEC (4-business-day disclosure for public companies), and state breach notification laws. Track notification deadlines and status.
Detection Gap Analysis
Analyze why the attack was not detected earlier: which security controls failed, which alerts were missed, what detection rules were absent. Calculate dwell time (time from initial compromise to detection). Map detection gaps to specific improvements.
Remediation and Hardening
Document immediate remediation steps (containment, eradication, recovery) and long-term hardening measures. Categorize by urgency: immediate (this week), short-term (this month), and strategic (this quarter). Each action must have an owner and deadline.
Copy-paste template
# Security Incident Postmortem — [Incident Title] **Classification:** [Confidential / Internal] ## Incident Summary - **Detection Date:** [Date] - **Estimated Compromise Date:** [Date] - **Dwell Time:** [Days] - **Severity:** [Critical/High/Medium] - **Attack Vector:** [Category] ## Attack Path (MITRE ATT&CK) | Phase | Technique | Evidence | |---|---|---| | Initial Access | [T####] | [Description] | | Lateral Movement | [T####] | [Description] | | Exfiltration | [T####] | [Description] | ## Data Impact | Data Type | Records Affected | Sensitivity | |---|---|---| | [Type] | [Count] | [PII/PHI/Financial] | ## Regulatory Notifications | Regulation | Deadline | Status | |---|---|---| | GDPR | [Date] | [Sent/Pending] | | State Laws | [Date] | [Sent/Pending] | ## Remediation | Action | Priority | Owner | Deadline | |---|---|---|---| | [Action] | Immediate | [Name] | [Date] |
Frequently asked questions
Generate instead of filling in templates
Connect your tools, and Vantage generates the content using real product data. Free to start.
Free to start. No credit card required.