ISO 27001 A.5.27: Learning from information security incidents

Make post-incident reviews mandatory for all incidents above a defined severity threshold. Schedule them within one to two weeks of closure while memories are fresh. Include everyone who was involved in the response.

Run the review as a blameless exercise focused on process improvement, not finger-pointing. Use a structured format: build a timeline from detection to resolution, perform root cause analysis (5 Whys or fishbone techniques work well), assess what went well in the response, identify what could be improved, evaluate whether existing controls were adequate, and generate specific recommendations.

Document everything in a formal lessons learned report. Each recommendation needs a clear action item with an assigned owner, priority, and target completion date. Actions might include: updating security controls, tuning detection rules, revising response procedures, improving training, strengthening access controls, patching vulnerabilities, or updating risk assessments.

Track implementation through your corrective action process. Report progress to management and ensure actions are completed on schedule. If resources are tight, escalate for prioritisation rather than letting actions go stale.

Periodically step back and analyse trends across multiple incidents. Look for recurring root causes, common attack vectors, repeated control failures, and organisational patterns. This trend analysis should feed into your annual risk assessment and security programme planning.