Conduct Post>Incident Reviews
Description
Conduct post-incident reviews. Post-incident reviews help prevent incident recurrence through identifying lessons learned and follow-up action.
Implementation Checklist
Tool Recommendations
Security orchestration, automation, and response platform with playbook automation and case management
Palo Alto Networks · Enterprise subscription
Security orchestration and automated response platform with playbooks, case management, and 350+ integrations
Cisco (Splunk) · Event-based subscription
Security incident response and vulnerability response with orchestration, workflow automation, and CMDB integration
ServiceNow · Enterprise subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Recurrence of Previously Experienced Incident Type
ConfidentialityThe organization suffers the same type of security incident repeatedly because no post-incident review was conducted to identify root causes and implement corrective actions after the first occurrence.
Same Attack Vector Exploited by Different Threat Actors
IntegrityMultiple threat actors exploit the same vulnerability or attack path because the organization never conducted a post-incident review to close the gap after the initial compromise.
Vulnerabilities (When Safeguard Absent)
No Post-Incident Review Process
Without post-incident reviews, the organization does not identify lessons learned, root causes, or corrective actions after security incidents, resulting in repeated exposure to the same attack vectors.
No Follow-Up Action Tracking from Incidents
Absence of post-incident reviews means remediation actions identified during incident response are not formally documented or tracked to completion, allowing identified weaknesses to persist.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Document | Recovery plan documentation | Reviewed annually |
| Record | Recovery test results and lessons learned | Tested quarterly |
| Document | Incident response plan and playbooks | Reviewed bi-annually |
| Record | Incident reports and post-incident review documentation | Per incident |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |