Root Cause and Control Failure Analysis Template
Purpose
Use this template to determine why an incident occurred and which cybersecurity, technical, business, or human controls failed or were missing.
The objective is to identify the conditions that allowed the incident to happen, not simply the final action that triggered it.
For example:
“An employee clicked a phishing link” is usually not a complete root cause.
The deeper questions may include:
- Why did the message reach the employee?
- Why could the stolen password be used?
- Why did the account have broad access?
- Why was suspicious activity not detected?
- Why could the attacker remain active?
Incident Information
Incident ID: ____________________
Incident: ____________________
Analysis owner: ____________________
Analysis date: ____________________
Participants: ____________________
1. Confirm the Incident Sequence
Summarize the sequence that led to the incident:
2. Initial Entry Point
How did the incident begin?
- Phishing
- Stolen credentials
- Exploited vulnerability
- Misconfiguration
- Vendor compromise
- Insider misuse
- Malware
- Lost device
- Exposed service
- Human error
- Unknown
- Other: ____________________
Evidence supporting this conclusion:
Confidence:
- Confirmed / Likely / Possible / Unknown
3. Immediate Cause
What directly allowed the incident to succeed?
Examples:
- User entered credentials into a phishing site.
- Internet-facing server was unpatched.
- Vendor account had excessive access.
- Public sharing was enabled.
- Administrator credential was stolen.
- Employee bank details were changed without verification.
4. Ask Why Repeatedly
Why 1
Why was the immediate cause possible?
Why 2
Why did that condition exist?
Why 3
Why was it not prevented or corrected?
Why 4
Why was it not detected earlier?
Why 5
What underlying process, ownership, technical, or management issue allowed the weakness to remain?
Not every incident requires exactly five levels. Continue until the analysis reaches conditions the company can meaningfully improve.
5. Preventive Control Failures
Which controls should have prevented or reduced the incident?
- MFA.
- Access control.
- Secure configuration.
- Patching.
- Email security.
- Endpoint protection.
- Network restriction.
- Vendor control.
- Payment verification.
- Data handling controls.
- Employee training.
- Separation of duties.
- Other: ____________________
For each failed control:
Expected control: ____________________
What actually existed: ____________________
Why it failed or was missing: ____________________
6. Detective Control Failures
Consider:
- Logging missing.
- Alert missing.
- Alert not monitored.
- Alert ignored.
- Insufficient log retention.
- Suspicious activity not recognized.
- Employee reporting delayed.
- External notification provided first indication.
Details:
7. Response Control Failures
Consider:
- Incident owner unclear.
- Escalation delayed.
- Contact information unavailable.
- Evidence lost.
- Containment incomplete.
- Compromised sessions remained active.
- Vendor response delayed.
- Decision authority unclear.
- Communications inconsistent.
Details:
8. Recovery Control Failures
Consider:
- Backups unavailable.
- Backup compromised.
- Restore not previously tested.
- Recovery priorities unclear.
- Dependencies unknown.
- Restore introduced previous weakness.
- Business validation incomplete.
- Recovery took longer than expected.
Details:
9. Business and Human Process Failures
Consider:
- Responsibility unclear.
- Excessive access.
- Weak onboarding.
- Weak offboarding.
- Shared accounts.
- Approval process bypassed.
- Vendor responsibilities unclear.
- Staff not trained.
- Procedure existed but was not followed.
- Procedure did not reflect actual operations.
- Security exception became permanent.
Details:
10. Root Cause Statement
Primary root cause:
Contributing factors:
What evidence supports this conclusion?
Confidence:
- Confirmed / Likely / Partial / Unknown
11. Required Improvements
For each root cause or material contributing factor:
Required action: ____________________
Control being improved: ____________________
Owner: ____________________
Priority: ____________________
Due date: ____________________
Verification method: ____________________
Evidence required: ____________________
Practical Rule
Do not stop at the last human mistake or technical failure.
Find the conditions that allowed the mistake or failure to become an incident.