Compliance · Incident response · Component
The post-incident review
Root cause and what changed, kept separate from the incident record itself so that learning is not mixed with the account of events.
The deliverable
What it is
The review has two subjects: what caused the incident and how well the response worked. Both produce findings and they are frequently conflated.
Reviews that assign responsibility produce less information than reviews that do not, because people describe what happened more accurately when doing so is safe.
One level in
What it is made of
Each element is a constituent part of the component. Follow one to see the attributes it carries.
The cause
What allowed the incident to happen.
3 attributes: Cause · Control involved · Failure type
LearnThe response assessment
How well the response actually worked.
3 attributes: Time to detection · Time to containment · Notifications on time
LearnThe changes
What was changed as a result, with owners and dates.
3 attributes: Change · Owner · Tracked in
Learn
Track post-incident changes in the same findings log as everything else. A separate list is a list nobody reads.
The other components in incident response
The incident definition
What counts as an incident, at what severity, written before one happens — so recognising it is not itself a judgement under pressure.
LearnThe response plan
Containment, roles, notification deadlines and who decides — settled in advance, because the clock runs during the incident.
Learn