Tools · Incident response playbooks · 23 / 23
An action item is not the change it names
A line in a review with an owner and a date is a task. The change it names is a later record: a config, a log, or a check that shows the task happened. Writing “done” on the line is not that record.
The line is the task
A review can list an action, a person, and a due date. That line says the team intends the change. It does not show the change. The system named in the line is unchanged until some other record says otherwise.
An owner is who accepted the task. The owner field is not proof the owner finished it.
Completion is a separate artifact
A finished task points at evidence: a setting you can read, a report that shows the new state, or a check someone reran. File that artifact with a time. If the only mark is the word done typed on the action line, write “completion evidence not attached.”
Moving the due date does not complete the task. It changes the promise.
What to write down
File the action text, the owner, the due date, and either the evidence of completion or the statement that it is not attached. Do not tell another team the control changed when you only have the action line.
Lab: a logging task marked done on the same day
The review for IR-2026-014 lists “send lab workstation logs to the lab collector,” owner lab-ops, due 2026-12-01. On 2026-11-03 someone typed done. No collector report is attached, and the collector’s host list was not opened.
The note quotes the task, the owner, and the typed word. Completion evidence: not attached. The collector is not described as receiving the logs. The due date is still a date on the task, not a proof.
ticket: IR-2026-014 action: send lab workstation logs to the lab collector owner: lab-ops due: 2026-12-01 status typed: done on 2026-11-03 collector report: not attached write: task plus a missing proof not: the logs are flowing
Diagram
The task line and the change
Done is a word until an artifact shows the new state.
Holds. The task, the owner, and a date
Status word. What someone typed
Does not. Show the system’s new state
Holds. A config, a report, or a repeated check
Time. When that artifact was read
Missing. The change is not claimed
Check yourself
1. A review line names a logging change, an owner, and a due date. What is that line?
2. Someone types done and attaches nothing. What do you write?
3. What can support “the logs are arriving”?