Comprehensive Recovery Assessment for Teams Emerging from Critical Incidents

Incident ID/Ticket Number

Incident Title/Descriptive Name

Incident Classification

Initial Severity Level (1 = Low, 5 = Critical)

Revised Severity Level after full assessment (1 = Low, 5 = Critical)

Date and Time Incident Was First Detected

Date and Time Incident Actually Began (if different from detection)

Which primary systems, services, or business functions were directly impacted? (Select all that apply)

Estimated Number of Customers/Users Affected

Estimated Financial Impact (Revenue Loss, Penalties, etc.)

Did this incident generate external media coverage or public social media attention?

How was the incident initially detected?

Was a physical location or specific geographic region relevant to this incident (e.g., data center, office, regional service)?

Has a formal Root Cause Analysis (RCA) document been completed and peer-reviewed?

What is the PRIMARY root cause category?

What CONTRIBUTING factors amplified the incident? (Select all that apply)

Was a recent change (code deploy, config change, infrastructure update) identified as a trigger?

Did the incident involve a third-party vendor, supplier, or external partner?

I confirm that the root cause analysis has been reviewed by at least one technical peer or architect who was not directly involved in the incident response.

Were there any attempts to obscure or delay disclosure of the true root cause during internal discussions?

How many core team members were directly involved in the incident response?

Which primary roles/functions were engaged? (Select all that apply)

Average number of hours worked per person during the active incident period

Average hours of sleep lost per person during the incident

Personal Stress & Well-Being Assessment (Rate each dimension based on your personal experience)

Which burnout indicators have you or your team members experienced? (Select all that apply)

Do you feel you had adequate managerial and organizational support during the incident?

Rate the effectiveness of the post-incident debrief or retrospective process (1 star = Poor, 5 stars = Excellent)

Do you believe team members need dedicated recovery time or mental health support following this incident?

Were there any interpersonal conflicts or communication breakdowns within the response team during the incident?

What positive aspects of teamwork or individual heroics should be recognized and celebrated?

Was an incident response plan or runbook available for this scenario?

Rate the effectiveness of communication channels used during the incident

How timely were stakeholder communications (executives, customers, partners)?

Which stakeholder groups experienced communication gaps or delays? (Select all that apply)

Rate the adequacy and accessibility of tools used during incident response

Were there any delays due to lack of decision-making authority or unclear ownership?

Which process gaps contributed to the incident or slowed response? (Select all that apply)

Did you have access to all necessary systems, credentials, and data needed to diagnose and resolve the issue?

What single process or communication improvement would have had the biggest impact on reducing resolution time?

How many distinct preventive action items have been identified from this incident?

Do you have confidence that leadership will provide adequate resources (budget, headcount, time) to complete these action items?

How will progress on these action items be tracked and reported?

Have success metrics and KPIs been defined to measure the effectiveness of these preventive measures?

Proposed date for first follow-up review of action items

How clear is the accountability structure for ensuring these action items are completed?

What systemic organizational changes (if any) are needed to prevent similar incidents across other teams or products?

Primary Incident Commander/Lead Investigator Signature

Team Manager/Department Head Signature (Acknowledging Support Commitment)