Incident response · The post-incident review · Element
The response assessment
How well the response actually worked.
The part
What it is
Time to detection, time to containment and whether notifications were made on time are the three measures that matter.
A well-handled incident with a fast response is a demonstration that the plan works, and that is worth recording as clearly as a failure.
The smallest level
The attributes it carries
Each attribute is one of the framework’s shared types. What a date is, and how it is written, is defined once for the whole model — the note here says what it means in this particular place.
The other elements in the post-incident review
The cause
What allowed the incident to happen.
LearnThe changes
What was changed as a result, with owners and dates.
Learn