Incident Timeline Calculator

Detection Date/Time

Containment Date/Time

Calendar Days

Business Days (Mon-Fri)

Buffer: days

Time to Contain --

Postmortem Due (with buffer) --

Assumptions: Postmortem due within 7 days of containment. Buffer added for internal safety margin.

Action & Evidence Tracker

Action / Evidence Item	Owner	Due Date	Status

Incident Severity Score

Likelihood of Recurrence (1–5)

1 (Low)2345 (High)

Business Impact (1–5)

1 (Minimal)2345 (Critical)

Severity Score

Medium Priority

Scoring: Low (1-6), Medium (7-12), High (13-17), Critical (18-25). For internal prioritization only.

Why Structured Postmortems Matter

A clear, timely postmortem turns incidents into improvement. It's critical for compliance frameworks (like SOC 2, ISO 27001), customer trust, and preventing repeat failures. Common pitfalls include vague root causes, missing action owners, and missing regulatory notification deadlines.

How to Use This Tool

Enter detection and containment times to calculate your response timeline.
Add every action item with an owner and due date to the tracker.
Use the severity score to prioritize review resources.
Generate and copy the template to your internal docs.

Example Timeline

Detection: 2024-03-15 14:30
Containment: 2024-03-15 18:45
Time to Contain: 4 hours 15 minutes.
Postmortem Due (with 2-day buffer): 2024-03-24

Common Mistakes Checklist

Blaming individuals instead of process gaps.

Setting unrealistic "prevent forever" actions.

Not involving legal/compliance early for reportable incidents.

Failing to document evidence chain (logs, access records).

Security Incident Postmortem Template

Incident Timeline Calculator

Action & Evidence Tracker

Postmortem Template Outline

Incident Severity Score

Why Structured Postmortems Matter

How to Use This Tool

Example Timeline

Common Mistakes Checklist

Frequently Asked Questions

How accurate is the timeline calculation?

What defines "containment"?

When should we consult legal?

Formulas & Assumptions

Important Disclaimer

Reference Concepts

Menu

Security Incident Postmortem Template

AI Assistant

Was this tool helpful?