Action Item
Definition
A specific, time-bound improvement task generated by a post-incident finding. An action item has a named owner, a target completion date, a measurable outcome, and a tracking record in a ticketing system. An action item is not a recommendation in a report; it is a work item assigned to a person.
- Trigger
- Post-incident finding
- Components
- Named owner, target date, measurable outcome
- Tracking
- Ticketing system record
- Distinction
- Assigned work, not merely a recommendation
Common questions
Why does a review distinguish an action item from a recommendation?+
A recommendation can sit in a report indefinitely with no one responsible for it, while an action item is assigned to a named person with a deadline and a defined outcome, which creates accountability that a recommendation alone does not.
What happens if an action item's target date passes without completion?+
A well-run tracking system flags the overdue item for escalation, so the delay itself becomes visible to management rather than quietly disappearing from a report no one revisits.
Related terms
- Blameless Post-Mortem
- A cultural approach to post-incident review, popularised in site reliability engineering, in which the analysis focuses on systemic and process failures rather...
- Lessons-Learned Register
- A persistent record, maintained by the security programme, that links each post-incident action item to the originating incident, tracks its status, and...
- Post-Incident Activity
- The NIST SP 800-61 label for the final phase of the incident response lifecycle. It encompasses evidence retention, lessons-learned meetings, and the...
- Root-Cause Analysis (RCA)
- A structured method for identifying the underlying systemic cause of a failure rather than its immediate trigger. Common techniques in incident review...
- Timeline Reconstruction
- The process of ordering digital events from multiple sources into a single chronological account. Requires normalising all timestamps to a common reference...