SANS Incident Handler's Handbook and PICERL Methodology

Phase 6: Lessons Learned – SANS Incident Handler's Handbook and PICERL Methodology

SANS Incident Handler's Handbook and PICERL Methodology L-1: L-1 Complete the documentation and write an incident report giving a play-by-play account

The team completes any documentation not finished during the incident and writes a report reviewing the whole incident step by step, able to answer who, what, where, why and how for each phase; it serves to improve the team, as reference for similar incidents, as training material for new members and as a benchmark for future crises.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Other controls in Phase 6: Lessons Learned – SANS Incident Handler's Handbook and PICERL Methodology

L-2 L-2 Hold a short lessons learned meeting within about two weeks, finalize an executive summary and agree improvements

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All SANS Incident Handler's Handbook and PICERL Methodology controls