Lessons-Learned Report
Definition
A post-incident review document identifying what succeeded, what failed, the root cause, and specific recommended changes to policy, tooling, or training. Produced in a structured meeting held within two weeks of incident closure and distributed to the CISO, IR lead, and risk committee.
- Contents
- What succeeded, what failed, root cause, recommendations
- Produced
- In a structured meeting within two weeks of closure
- Distributed to
- CISO, IR lead, risk committee
- Recommendations cover
- Policy, tooling, training changes
Common questions
How does a lessons-learned report differ from an incident report?+
An incident report documents facts and chronology for the record, often for legal or regulatory purposes, while the lessons-learned report is forward-looking, focused specifically on root cause and concrete changes to prevent recurrence.
Why is the report routed to a risk committee rather than kept within the IR team?+
Recommendations often require budget, staffing, or policy authority beyond what the incident response team controls, so escalation to leadership and risk governance is needed to actually implement the changes identified.
Related terms
- Breach Notification
- The legal obligation to inform regulators and affected individuals when personal data is compromised in a security incident. Timelines and thresholds differ...
- Chain of Custody
- The documented chronological record of who collected, handled, transferred, and examined a piece of evidence. For digital evidence, chain of custody includes...
- Incident Ticket
- The structured record opened in an IT service management or case management system when an alert is escalated to an incident. It...
- Post-Incident Report
- The formal written account produced after an incident is closed. It synthesises the timeline log into a structured narrative covering the incident...
- Timeline Log
- A chronological, append-only record capturing every analyst action and finding during the response, time-stamped at the moment of entry in UTC. It...