Skip to main content
← All controls
IR-4(6) / A.16.1.6 / CIS-17.9 NIST SP 800-53 Rev 5

After previous incidents (or near-misses), are lessons documented and acted on?

Demonstrate that the organization systematically documents lessons learned from security incidents and near-misses, and implements corrective actions that result in measurable improvements to security controls, processes, or detection capabilities.

Description

What this control does

This control ensures that organizations systematically capture lessons learned from security incidents and near-miss events, document them in a structured format, and implement corrective and preventive actions. The process typically involves post-incident review meetings, root cause analysis, documentation of findings in an incident knowledge base, and tracking of remediation tasks through completion. Effective implementation prevents recurrence of similar incidents, improves detection capabilities, and continuously strengthens the security posture based on real-world experience rather than theoretical threats alone.

Control objective

What auditing this proves

Demonstrate that the organization systematically documents lessons learned from security incidents and near-misses, and implements corrective actions that result in measurable improvements to security controls, processes, or detection capabilities.

Associated risks

Risks this control addresses

  • Repeated exploitation of the same vulnerability or attack vector due to failure to remediate root causes after initial compromise
  • Missed opportunity to detect similar attack patterns early because indicators of compromise were not integrated into monitoring systems
  • Organizational knowledge loss when incident responders leave without documented lessons, forcing teams to re-learn from future incidents
  • Failure to address systemic weaknesses in security controls, processes, or configurations that enabled the initial incident
  • Regulatory penalties or liability exposure from demonstrating negligence through repeated similar incidents without corrective action
  • Resource waste responding to preventable incidents that could have been mitigated through implemented lessons learned
  • Erosion of stakeholder confidence when the organization fails to improve after publicly disclosed or customer-impacting security events

Testing procedure

How an auditor verifies this control

  1. Obtain the incident register or ticketing system records for the past 12-24 months and identify all closed security incidents and documented near-miss events
  2. Select a representative sample of 5-10 incidents spanning different severity levels, including at least one high-severity incident and one near-miss event
  3. For each sampled incident, retrieve the post-incident review documentation, lessons learned reports, or after-action reviews
  4. Verify that each lessons learned document includes root cause analysis, timeline of events, identified control gaps, and specific recommended actions with assigned owners
  5. Cross-reference documented recommendations against change management records, vulnerability remediation tickets, policy updates, or configuration changes to verify implementation
  6. Interview incident response personnel and ask them to describe how specific past incidents influenced current detection rules, playbooks, or security controls
  7. Review security monitoring configurations, SIEM rules, or threat intelligence feeds to confirm integration of indicators of compromise or attack patterns from documented incidents
  8. Examine metrics or KPIs tracking repeat incidents to determine whether similar incidents have decreased following implementation of lessons learned
Evidence required Collect post-incident review reports or lessons learned documents with timestamps and attendee lists, change management tickets or Jira records showing closed remediation tasks linked to specific incidents, configuration exports from SIEM or EDR systems showing rules added based on past incidents, before-and-after policy versions demonstrating updates prompted by incident findings, and incident trend analysis reports or dashboards showing frequency of similar incident types over time.
Pass criteria The control passes if all sampled incidents have documented lessons learned with identified actions, at least 80% of documented actions show evidence of completion through change records or implemented controls, and no repeat incidents of the same root cause are observed without documented justification for accepted risk.