CIM Post-Incident Analysis & Reporting 3 — Questions and Answers
Question 1: What is the recommended tone for a post-incident report to promote psychological safety and honest reporting?
- Accusatory, naming individuals who made mistakes
- Blameless, focusing on systemic issues rather than individual fault (Correct answer)
- Confidential, shared only with senior leadership
- Technical, written exclusively for engineers
Correct answer: Blameless, focusing on systemic issues rather than individual fault
A blameless culture encourages honest disclosure of errors by focusing on process and system failures rather than punishing individuals.
Question 2: Which metric in a post-incident report specifically measures how long the incident remained undetected after it began?
- Mean Time to Repair (MTTR)
- Mean Time to Detect (MTTD) (Correct answer)
- Recovery Time Objective (RTO)
- Service Level Agreement (SLA) breach duration
Correct answer: Mean Time to Detect (MTTD)
MTTD measures the elapsed time between when an incident starts and when it is first detected by responders or monitoring systems.
Question 3: When multiple teams are involved in an incident response, what section of the post-incident report documents who did what and when?
- Executive summary
- Chronological action log / incident timeline (Correct answer)
- Financial impact assessment
- SLA compliance section
Correct answer: Chronological action log / incident timeline
The chronological action log documents each team's actions with timestamps, providing accountability and enabling analysis of coordination effectiveness.
Question 4: Which of the following best describes a 'systemic root cause' found in a post-incident analysis?
- A single misconfigured server
- An underlying organizational, cultural, or process weakness that enabled the failure (Correct answer)
- A vendor hardware defect
- An operator who did not follow the runbook
Correct answer: An underlying organizational, cultural, or process weakness that enabled the failure
Systemic root causes are organizational or process-level weaknesses that create conditions for multiple potential failure modes.
Question 5: A post-incident report notes the incident 'escaped detection for 4 hours due to alert fatigue.' What type of finding is this?
- Hardware failure finding
- Process and tooling finding related to monitoring effectiveness (Correct answer)
- Vendor SLA violation
- Change management finding
Correct answer: Process and tooling finding related to monitoring effectiveness
Alert fatigue is a process/tooling problem where excessive or low-signal alerts cause responders to miss or ignore critical notifications.
Question 6: What should an incident manager do if a corrective action from a previous PIR remains unimplemented at the time of a new similar incident?
- Ignore the prior action and start fresh analysis
- Reference the unimplemented action, escalate urgency, and link it as a contributing factor in the new report (Correct answer)
- Close the old action and open a new one
- Reassign the action without documentation
Correct answer: Reference the unimplemented action, escalate urgency, and link it as a contributing factor in the new report
Unimplemented corrective actions that contribute to recurrent incidents must be escalated, linked in the new report, and treated with higher priority.
Question 7: In post-incident analysis, 'latent conditions' refer to which of the following?
- Active failures committed by operators during the incident
- Pre-existing hidden flaws in systems or processes that become dangerous when combined with a trigger (Correct answer)
- Customer-reported symptoms logged after the incident
- Metrics that were not monitored during the incident
Correct answer: Pre-existing hidden flaws in systems or processes that become dangerous when combined with a trigger
Latent conditions (from James Reason's Swiss Cheese Model) are dormant weaknesses in systems that remain harmless until aligned with other failure factors.
CIM Post-Incident Analysis & Reporting 3
What is the recommended tone for a post-incident report to promote psychological safety and honest reporting?