Lessons-Learned Register
Definition
A persistent record, maintained by the security programme, that links each post-incident action item to the originating incident, tracks its status, and records the evidence of completion. The register is the mechanism by which the IR programme accumulates institutional knowledge over time.
- Type
- Persistent tracking record
- Maintained by
- Security programme
- Tracks
- Action item, source incident, status, completion evidence
- Purpose
- Accumulate institutional knowledge over time
Common questions
How does a lessons-learned register differ from a single lessons-learned report?+
A report is a one-time document produced after a specific incident, while the register is an ongoing ledger that aggregates action items across many incidents over time and tracks whether each one was actually completed.
Why does completion evidence matter in the register?+
Without recorded evidence, an action item can be marked closed without the underlying fix, such as a new detection rule or patched process, ever being verified as implemented, which defeats the register's purpose of driving real improvement.
Related terms
- Action Item
- A specific, time-bound improvement task generated by a post-incident finding. An action item has a named owner, a target completion date, a...
- Blameless Post-Mortem
- A cultural approach to post-incident review, popularised in site reliability engineering, in which the analysis focuses on systemic and process failures rather...
- Post-Incident Activity
- The NIST SP 800-61 label for the final phase of the incident response lifecycle. It encompasses evidence retention, lessons-learned meetings, and the...
- Root-Cause Analysis (RCA)
- A structured method for identifying the underlying systemic cause of a failure rather than its immediate trigger. Common techniques in incident review...
- Timeline Reconstruction
- The process of ordering digital events from multiple sources into a single chronological account. Requires normalising all timestamps to a common reference...