The post-incident review is the single most valuable activity your organisation can perform after a security incident — and it is the one most frequently skipped. Once the crisis is over, the natural inclination is to return to normal operations as quickly as possible. But without a structured review, the same vulnerabilities, the same process gaps, and the same mistakes will recur.
How to Conduct an Effective Review
Schedule the review within two weeks of incident closure, while memories are fresh. Include all IR team members and key stakeholders. The review should be blame-free — the goal is to improve the system, not to punish individuals.
Address these questions:
- What happened? Create a factual timeline of the incident from initial detection to closure.
- What worked well? Identify processes, tools, and decisions that were effective. Reinforce and document these.
- What did not work? Identify gaps in detection, delays in containment, communication failures, or confusion about roles.
- What should change? Define specific, actionable improvements with owners and deadlines.
- Were regulatory obligations met? Confirm that all notification requirements were fulfilled within the required timeframes.
Turning Lessons into Action
The output of the review must be a written report with a concrete action plan. Each action item needs an owner, a deadline, and a mechanism for tracking completion. Common post-incident improvements include:
- Updating the IR plan to address gaps identified during the response.
- Deploying additional detection rules based on the attacker’s tactics.
- Improving logging coverage for systems that lacked visibility.
- Training staff on specific weaknesses observed (e.g. phishing identification, escalation procedures).
- Revising access controls to reduce the blast radius of future incidents.
Diagram
Post-Incident Review Process
Five-step flow: Create Timeline, Identify What Worked, Identify Gaps, Define Actions, Track to Completion — feeding improvements back into the IR plan.
Action Steps
- Mandate post-incident reviews in your IR plan — make them non-optional.
- Schedule the review within two weeks of incident closure.
- Ensure the review output includes a written action plan with owners and deadlines.
- Track action item completion and report progress to the executive sponsor.
Quick Knowledge Check
- Why is the post-incident review the most frequently skipped phase?
After a crisis, teams naturally want to return to normal operations. The urgency is gone, so the review feels less critical — even though it is where the most long-term value is generated. - What five questions should a post-incident review address?
What happened? What worked? What did not work? What should change? Were regulatory obligations met?