# Root Cause Analysis (RCA)

Writes a structured root cause analysis for a resolved incident, based on the facts you supply. Use it after a service disruption or security incident to document what happened, why, and what prevents recurrence.

## Prompt

## Context
You are an IT engineer or security analyst writing a post-incident root cause analysis (RCA) for [INCIDENT ID]. The incident affected [AFFECTED SYSTEMS OR SERVICES] and impacted [USER OR BUSINESS IMPACT]. Incident timeline from your records: [TIMELINE, list of date-time and event pairs]. Root cause as determined by your team: [ROOT CAUSE]. Contributing factors: [CONTRIBUTING FACTORS]. Corrective actions taken: [CORRECTIVE ACTIONS TAKEN]. Preventive actions planned: [PREVENTIVE ACTIONS PLANNED]. RCA audience: [AUDIENCE, e.g., internal IT, management, customer].

## Task
Write an RCA document with these sections:
1. Executive Summary: two to three sentences covering what happened, when, and the business impact.
2. Timeline: the events from my records, formatted as a clear chronological list.
3. Root Cause: what the team determined, with a plain explanation of the causal chain.
4. Contributing Factors: any conditions that made the incident worse or harder to detect.
5. Corrective Actions: what was done to resolve it.
6. Preventive Actions: what will stop this from recurring, with owners and target dates from my inputs.

## Standards
- Factual and neutral. This is a learning document, not a blame document.
- Use only the timeline, root cause, and actions I provided. Do not invent events, error messages, CVEs, log entries, hostnames, or findings.
- Preventive actions must come from my input. Do not add recommendations I did not supply.
- Adjust depth and technical detail to match the stated audience.
- If timeline or root cause is missing, ask before drafting.

## Variables

- [INCIDENT ID]
- [AFFECTED SYSTEMS OR SERVICES]
- [USER OR BUSINESS IMPACT]
- [TIMELINE]
- [ROOT CAUSE]
- [CONTRIBUTING FACTORS]
- [CORRECTIVE ACTIONS TAKEN]
- [PREVENTIVE ACTIONS PLANNED]
- [AUDIENCE]

## Input checklist

- [ ] The incident timeline pulled from your ticketing system, monitoring tools, or change log, not reconstructed from memory
- [ ] The root cause your team agreed on, not a guess. If root cause is still being debated, note that before drafting
- [ ] Owners and target dates for every preventive action, from your team's actual commitments
- [ ] All system names, hostnames, and service names must come from your own environment, not from the AI
- [ ] Redact customer PII, internal credentials, and any data classified above the document's intended distribution before pasting

## Verification checklist

- [ ] Every event in the timeline matches your ticketing system or monitoring tool output, not what the AI reconstructed
- [ ] No fabricated CVEs, log lines, error codes, hostnames, or IP addresses appear in the document
- [ ] The root cause section reflects what your team determined, not a plausible alternative the AI inserted
- [ ] Preventive actions are ones your team actually owns, with owners and dates from your input
- [ ] The business impact statement matches what really happened, not an amplified version
- [ ] The document is written at the right level for the stated audience, and no sensitive data will reach unintended recipients

## Sample output

Sample output. Generated by AI from sample inputs:

RCA: INC-7741 | Email Service Outage | Northwind Fabrication

Executive Summary
On June 10, Northwind Fabrication's internal email service was unavailable for 2 hours and 17 minutes, from 0913 to 1130. All 240 employees were unable to send or receive email. The outage was caused by a misconfigured certificate renewal that allowed the mail server's TLS certificate to expire without alert.

Timeline
- 0913: Monitoring alert fires for SMTP (Simple Mail Transfer Protocol) connection failures on NW-MAIL-01.
- 0921: Tier 2 engineer confirms TLS certificate expired at 0900.
- 0934: Replacement certificate requested from internal PKI (Public Key Infrastructure).
- 1045: Certificate issued and installed on NW-MAIL-01.
- 1118: Service restored; delivery queue clearing.
- 1130: All pending messages delivered. Incident declared resolved.

Root Cause
The TLS certificate for NW-MAIL-01 was not enrolled in the certificate lifecycle monitoring system during a mail server migration in March. No automated renewal or expiration alert was configured for this certificate.

Contributing Factors
- Migration checklist did not include a step to register new assets in the certificate monitoring system.
- Manual certificate inventory was last audited in January.

Corrective Actions
- Expired certificate replaced and email service restored by 1130.

Preventive Actions
- Owner: Network Team | Target: June 28 | Register all certificates on NW-MAIL-01 and NW-MAIL-02 in the certificate monitoring platform.
- Owner: Change Management | Target: July 15 | Add certificate registration as a mandatory checklist item in the server migration runbook.

## Customization notes

For security incidents, add a section between Contributing Factors and Corrective Actions called Indicators of Compromise (IoCs), and populate it only with IoCs your team identified from your own tools. Management-audience versions can cut the technical detail from the timeline and expand the Executive Summary. If your organization uses a standard RCA template in Confluence or SharePoint, use this output as the first draft and paste into that template.

---

From The IT & Cybersecurity Library at vetslearn.com/libraries/it-cyber