SANS Incident Handler's Handbook and PICERL Methodology
Phase 6: Lessons Learned – SANS Incident Handler's Handbook and PICERL Methodology

SANS Incident Handler's Handbook and PICERL Methodology L-2: L-2 Hold a short lessons learned meeting within about two weeks, finalize an executive summary and agree improvements

A lessons learned meeting is held as soon as possible, as a rule of thumb within two weeks of the incident, going through the report and finalizing it as an executive summary; it stays short and professional and covers when and by whom the problem was detected, the scope, how it was contained and eradicated, recovery work, where the team was effective and where it must improve, with time for suggestions; the checklist asks for an explanation if no mistakes or improvements were discussed.

Maintained by Gerard BlokdykControl text last updated

Other controls in Phase 6: Lessons Learned – SANS Incident Handler's Handbook and PICERL Methodology

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll SANS Incident Handler's Handbook and PICERL Methodology controls