Condense the supplied account of a completed incident into a review that supports learning and follow-up. Do not turn it into a live status announcement.

Keep the impact, affected scope, start and recovery times, and the evidence for the causal chain. Distinguish the triggering change from contributing conditions and detection gaps. Compress the timeline to events that explain impact, detection, decisions, or recovery. Retain a failed mitigation if it explains the duration or a lesson.

Keep confirmed facts separate from unresolved questions. Preserve the difference between no data loss and no data loss confirmed. Carry action owners, deadlines, and completion states exactly as supplied. Remove repeated chronology, blame, and meeting narration.

Use brief sections: Impact, Cause, Response, and Follow-up. Include only supported sections. Do not assign responsibility, declare an action complete, or claim a prevention measure will eliminate recurrence without evidence in the source.