17.8
IG2 IG3

Conduct Post>Incident Reviews

Asset Type: N/A
Security Function: Recover

Description

Conduct post-incident reviews. Post-incident reviews help prevent incident recurrence through identifying lessons learned and follow-up action.

Implementation Checklist

1
Define recovery objectives (RTO/RPO)
2
Implement recovery capabilities and procedures
3
Test recovery procedures on a regular schedule
4
Document recovery procedures and contact information
5
Develop incident response plan and playbooks
6
Define roles, escalation paths, and communication channels
7
Conduct tabletop exercise to validate plan
8
Establish post-incident review process

Threats & Vulnerabilities (CIS RAM)

Threat Scenarios

Recurrence of Previously Experienced Incident Type

Confidentiality

The organization suffers the same type of security incident repeatedly because no post-incident review was conducted to identify root causes and implement corrective actions after the first occurrence.

Same Attack Vector Exploited by Different Threat Actors

Integrity

Multiple threat actors exploit the same vulnerability or attack path because the organization never conducted a post-incident review to close the gap after the initial compromise.

Vulnerabilities (When Safeguard Absent)

No Post-Incident Review Process

Without post-incident reviews, the organization does not identify lessons learned, root causes, or corrective actions after security incidents, resulting in repeated exposure to the same attack vectors.

No Follow-Up Action Tracking from Incidents

Absence of post-incident reviews means remediation actions identified during incident response are not formally documented or tracked to completion, allowing identified weaknesses to persist.

Evidence Requirements

Type Evidence Item Collection Frequency
Document Recovery plan documentation Reviewed annually
Record Recovery test results and lessons learned Tested quarterly
Document Incident response plan and playbooks Reviewed bi-annually
Record Incident reports and post-incident review documentation Per incident
Document Governing policy document (current, approved, communicated) Reviewed annually

Related Policy Templates