Lessons Learned
What is Lessons Learned?
The documented knowledge gained from experiences, both positive and negative, used to improve future performance and prevent recurring issues.
Terms that appear alongside lessons learned
Each of these is named in at least one of the same controls as lessons learned. The number is how many controls name both.
- incident response 54 shared controls
- nist 35 shared controls
- breach notification 28 shared controls
- security incident 27 shared controls
- cybersecurity 25 shared controls
- remediation 24 shared controls
- audit 23 shared controls
- business continuity 22 shared controls
Frameworks that govern lessons learned
What the standards actually require on lessons learned
Requirements naming lessons learned across 6 standards, quoted from the control text.
The plan must require continuous improvement processes in which lessons learned are reviewed for changes they may call for in the recovery strategy.
api-1164::RC.IM-2 · RC.IM-2 Recovery strategy updated from lessons learned →Lessons-learned activities follow incidents and corrective actions are taken, including updates to the incident response plan.
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-3h · RESPONSE-3h: Lessons learned captured and acted on →The appointing party, working with each lead appointed party, shall record the lessons learned on the project in a knowledge store so later projects can use them; doing this throughout the project, not only at the end, is recommended.
iso-19650-organisation-and-digitisation-of-information-about-buildings-and-civil-engineering-works-bim::2:5.8.2 · 5.8.2 Capture lessons learned for future projects →A lessons learned meeting is held as soon as possible, as a rule of thumb within two weeks of the incident, going through the report and finalizing it as an executive summary;
sans-incident-handlers-handbook-and-picerl-methodology::L-2 · L-2 Hold a short lessons learned meeting within about two weeks, finalize an executive summary and agree improvements →After scenario testing or an actual operational disruption, a firm must carry out a lessons learned exercise to find weaknesses and then make the improvements needed to stay within its impact tolerances.
uk-fcapra-operational-resilience-framework::F-5.8 · Run lessons learned after tests and real disruptions and make the improvements →Lessons learned and improvement. Implements CyFun RS.IM-1 / RS.IM-2: response activities incorporate lessons learned and response strategies are updated.
BE-CF-22 · Lessons learned and improvement →Questions people ask about lessons learned
What is Lessons Learned?
Why is Lessons Learned important for compliance?
Which compliance frameworks address Lessons Learned?
Where can I learn more about Lessons Learned?
See how Lessons Learned applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.