Post-incident activity: root cause analysis, lessons learned, updating playbooks and controls

Post-incident activity is the phase that turns a painful event into a stronger organization. Without it, the same weaknesses produce the same incidents. It happens after the incident is resolved, but ideally soon, while details are fresh, often within a couple of weeks. The two main activities are root cause analysis and the lessons learned process, and both are only valuable if they lead to changes in playbooks and controls.