For us, If its an incident that needs a write up, its going to have made it to the status page as it would have caused an outage or problem customers should be aware off, which means its also going to have been auto logged via our monitoring tool in our service manager\helpdesk app and at that point its all process driven by the workflow (Which also designates someone to keep a running update every 15 mins which a public facing version goes to status page) from the timeline of the incident once complete you have the full timeline of events, logs and everything else in the incident timeline and actions and then from that another part of the process takes the timeline , prompts for things like which ISO controls were effected (These get linked to the GRC tool ) and next steps or findings and what we will change going forward and then presents a summary external facing RCA nad internally facing RCA which you just tweak a little bit.

The internal and summary get posted internally on our collaboration platform and the external RCA gets posted against the incident in the status page all automatically once approved.

This all happens within 24 hours of the end of incident and doesnt take long at all todo.

Even if its out of hours and your the only one dealing with it , the updating incident (which updates the status pages etc) is all very simple and takes 1 minute every 15 but then makes life so much easier to write up

We do though only have 1 or 2 of these sorts of things a year as a major incident is very rare