Incident response · The post-incident review · Element
The cause
What allowed the incident to happen.
The part
What it is
Usually a chain rather than a single point, and the useful entries are the ones the organisation can change.
Where a control existed and did not prevent the incident, that is a control design finding rather than an operational one.
The smallest level
The attributes it carries
Each attribute is one of the framework’s shared types. What a date is, and how it is written, is defined once for the whole model — the note here says what it means in this particular place.
The other elements in the post-incident review
The response assessment
How well the response actually worked.
LearnThe changes
What was changed as a result, with owners and dates.
Learn