| Cues | - What were you focusing on?
- What was not noticed?
- What differed from what was expected?
|
| Previous Knowledge/Experience | - Was this an anticipated class of problem or did it uncover a class of issue that was not architecturally anticipated?
- What expectations did participants have about how things were going to develop?
- Were there similar incidents in the past?
|
| Goals | - What goals governed your actions at the time?
- How did time pressure or other limitations influence choices?
- Was there work the team chose not to do in the past that could have prevented or mitigated this incident?
|
| Assessment | - What mistakes (for example, in interpretation) were likely?
- How did you view the health of the services involved prior to the incident?
- Did this incident teach you something that should change views about this service’s health?
|
| Taking Action | - How did you judge you could influence the course of events?
- What options were taken to influence the course of events? How did you determine that these were the best options at the time?
- How did other influences (operational or organizational) help determine how you interpreted the situation and how you acted?
|
| Help | - Did you ask anyone for help?
- What signal brought you to ask for support?
- Were you able to contact the people you needed to contact?
|
| Process | - Did the way that people collaborate, communicate, and/or review work contribute to the incident?
- What worked well in your incident response process and what did not work well?
|