NIST SP 800-61 NISTSP61-6: Post-Incident Activity: Lessons Learned, Evidence Retention, Metrics

Conduct Post-Incident Activity per NIST SP 800-61 Rev 2 Section 3.4. Tasks include (a) Lessons Learned Meeting per Section 3.4.1: held within several days of the end of every major incident with attendees including the handlers + management + appropriate external parties, structured to answer questions about (what happened + how well did staff and management perform + were documented procedures followed + were they adequate + what would the staff and management do differently next time + how could information sharing with other organisations have been improved + what corrective actions can prevent similar incidents + what precursors or indicators should be watched for to detect similar incidents + what additional tools or resources are needed), (b) Using Collected Incident Data per Section 3.4.2: incident response metrics (number of incidents handled + time per incident + objective and subjective assessment of each incident), (c) Evidence Retention per Section 3.4.3: how long is evidence retained (prosecution + data retention + cost considerations + chain of custody requirements). Produce a follow-up report per major incident with executive summary + detail + recommended improvements + tracking of recommendations to closure.