Post-Incident Review
What is Post-Incident Review?
A structured evaluation conducted after a security incident to identify lessons learned and improvement opportunities for future prevention and response.
Terms that appear alongside post-incident review
Each of these is named in at least one of the same controls as post-incident review. The number is how many controls name both.
- incident response 19 shared controls
- lessons learned 15 shared controls
- business continuity 12 shared controls
- breach notification 10 shared controls
- nist 9 shared controls
- cybersecurity 8 shared controls
- incident management 8 shared controls
- audit 7 shared controls
Frameworks that govern post-incident review
What the standards actually require on post-incident review
Requirements naming post-incident review across 6 standards, quoted from the control text.
Maintain recordkeeping + communications strategy + post-incident review + board reporting per OAIC guidance and Privacy Act section 26WL recordkeeping expectations.
AUNDB-A7 · Recordkeeping, Communications Strategy, Post-Incident Review, Board Reporting →Hold reviews after incidents, which help stop incidents from happening again by drawing out lessons learned and follow-up actions.
CIS-17.8 · Conduct Post-Incident Reviews →Hold reviews after incidents to identify lessons and follow-up actions that help stop incidents happening again. Implementation Groups: IG2 and IG3 (not in the IG1 baseline; applies from IG2 upward). Asset type: Users. Security function: Recover.
cis-controls-v8-1::17.8 · Conduct Post-Incident Reviews →Agencies should formally share their post-incident review reports with the NCSC by email to incidents@ncsc.govt.nz.
new-zealand-information-security-manual-nzism::7.2.20.C.03 · 7.2.20.C.03 Share post-incident review reports with NCSC →Operate incident detection + response + customer notification + post-incident review + BCM per scheme + applicable regulation. Incident detection and classification must (a) implement SIEM + EDR + fraud detection + with open banking-aware correlation rules + (...
OPENBANK-8 · Incident Detection, Response, Customer Notification, Post-Incident Review, BCM →Providers must manage the people responsible for security appropriately, in particular by establishing and regularly reviewing a security policy that includes incident management at varying severities, a standard way of categorising incidents, channels for rep...
uk-telecommunications-security-act-2021::r10 · reg.10 Govern security from board level: policy, incident categorisation, risk reporting, post-incident review and insider risk →Questions people ask about post-incident review
What is Post-Incident Review?
Why is Post-Incident Review important for compliance?
Which compliance frameworks address Post-Incident Review?
Where can I learn more about Post-Incident Review?
See how Post-Incident Review applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.