← CIS Controls v8 in plain English

17.8 IG2

Control 17 / Incident Response Management

Conduct Post-Incident Reviews

Think of it likeTalking about what went right and wrong after an emergency drill to improve next time.

In plain English

The family discusses what worked and what didn’t after an incident, just as they would review the outcomes of an emergency drill to improve their response for the future.

Related CSF subcategories (unofficial mapping)

ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities.RC.RP-06: The end of incident recovery is declared based on criteria, and incident-related documentation is completed.RS.AN-03: Analysis is performed to establish what has taken place during an incident and the root cause of the incident.