Safeguard
Security Guides•

How long should a supply chain postmortem be?

Most supply chain postmortems fit in two to five pages. Match length to learning, put the summary first and move raw data into appendices for readers.

Safeguard Security Team
3 min read

Most postmortems read well at two to five pages, with a one paragraph summary on top and evidence in appendices. There is no official length. Aim for the shortest document that lets a stranger understand what happened, why, and what will change.

Length follows purpose

Google's SRE book describes a postmortem as a written record of the incident, its impact, the actions taken, the root causes and the follow up actions. Its goals are documentation, understanding of causes and effective prevention. A document that does those three things is long enough. Anything beyond is for reference, and belongs elsewhere.

A size guide by incident type

IncidentTypical shape
Near miss or false alarmOne page, or a few lines in the incident log
Contained, small exposureTwo pages plus appendix
Broad exposure, credentials rotatedThree to five pages plus appendix
Multi team, customer notifiedFive or more pages, and a separate customer summary

These are rules of thumb, not standards. Your teams will find their own.

What stays in the body

  • Summary of five sentences.
  • Impact, with confirmed, exposed and unknown status.
  • A short timeline with only decision points.
  • Causes and contributing factors.
  • Actions with owners and dates.
  • What went well and where you got lucky.

What moves to the appendix

  • Raw logs and long command output.
  • Full hash lists and version lists.
  • Detailed credential rotation tables.
  • Chat transcripts and meeting notes.
  • Draft customer messages.

Link each appendix item from the line that relies on it. Readers who need the detail can follow the link, and the rest are not slowed down.

Signs it is too long

  • The summary is longer than a paragraph.
  • The timeline lists every message sent.
  • Readers ask questions the document answers on page six.
  • Actions are buried under narrative.

Signs it is too short

  • Nobody outside the team can follow it.
  • Impact says "none" without evidence.
  • Causes stop at one external event.
  • Actions have no owner or date.

Test with a cold reader

Give the draft to someone who was not involved and ask them to explain it back in two minutes. Their gaps show what to add. Their boredom shows what to cut. SRE review guidance also asks whether the root cause was sufficiently deep and whether the action plan is appropriate, so ask your reviewer those too.

Length is not rigour

A long postmortem is not a better one. Depth shows in the quality of the causes and the clarity of the actions, not in the page count. If you find yourself padding to look thorough, stop and ask what a reader would do differently after each paragraph. If the answer is nothing, cut it. Equally, do not shorten by dropping uncertainty. A short document that says what you do not know is stronger than a long one that hides it.

Quick check

Is a one page postmortem acceptable?

Yes for a near miss or small contained event, as long as impact, cause and actions are clear.

Should the timeline include every message?

No. Keep decision points in the body and keep the full record in an appendix.

Sources

Last reviewed: 19 October 2026.

Never miss an update

Weekly insights on software supply chain security, delivered to your inbox.

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.