D. Debrief
STARTS WHENLoop exited, technical closure and risk acceptance both signed.
DONE WHENImprovement plan issued with named owners and milestone dates.
This is the phase other traditions call lessons learned, the post-mortem, or root cause analysis. Same activity, whichever name your organization uses.
Closing the incident and turning it into changes are one activity. Funding stays available for about a month after closure, while the board still remembers being frightened, so arrive with the improvement plan already costed and an owner and a date on every line.
Close
| # | Item |
|---|---|
| 1 | Debrief scope and documentation requirements determined |
| 2 | Every temporary asset decided: isolated systems, forensic images, temporary accounts, extra monitoring. Keep, modify, or decommission. |
| 3 | Documentation consolidated from tickets, chat, shared documents, and personal notes into one authoritative record |
| 4 | Metrics captured in the standard format |
Learn
| # | Item |
|---|---|
| 5 | After-action review held within one to two weeks of closure |
| 6 | Every team that took part invited |
| 7 | Timeline and findings summary prepared in advance rather than built in the room |
| 8 | Blameless ground rules set, discussion held on controls, procedures, and resources, individual performance handled separately |
| 9 | Incident report developed where one is required |
| 10 | Findings and the funding request presented to stakeholders |
| 11 | Improvement register issued with owners and milestone dates |
| 12 | Preparation checklist reopened against the findings |