Creating a company culture that can weather failure

Do use all your resources

There are plenty of templates for incident response, though fewer that cover how to lean from incidents. Etsy’s Morgue tracker is open source and the company has also published an excellent debriefing facilitation guide.

The learning review process is as much about as communications as technology. “Business executive coaches who normally tackle lines of communications within the organization can address this area as well; not the technical aspects of where you need to pull information from, but what you do with it afterwards,” said Nather.

Do spread the word — inside and out

Part of making sure the knowledge you can gain from an incident is applied is passing on what you’ve learned.

“Make sure the resulting lessons are simply explained and made available for the entire organization to learn from,” said Hinchcliffe. “It's this last part that is frequently omitted and can doom organizations to proverbially relive IT history over and over again.”

You also want to share the lessons beyond your organization, suggests Nather. There are formal organizations like the Information Technology Information Sharing and Analysis Center, as well as similar organizations for financial services, oil and gas, healthcare, automotive, retail and legal, and plenty of informal routes for sharing intelligence. There’s a value in supporting and formalizing that, suggests Nather.

“If you have meeting space to offer for these folks to get together and talk, by virtue of being the leader who organizes it you immediately improve the standing of your own organization.”

Instead of treating failure as a threat to your reputation, sharing information says that you’re mature enough to cope with problems and learn from them — and that’s the culture you need to encourage.