Title Conduct lessons learned exercise
ID RA6002
Description Conduct Lessons Learned exercise
Author @atc_project
Creation Date 2019/01/31
Category General
Stage RS0006: Lessons Learned


The Lessons Learned phase evaluates the team's performance through each step. The goal of the phase is to discover how to improve the incident response process.
You need to answer some basic questions, using developed incident report:

  • What happened?
  • What did we do well?
  • What could we have done better?
  • What will we do differently next time?

The incident report is the key to improvements.