The Lessons-Learned Meeting That Went Nowhere
Two weeks after a contained ransomware incident, the incident commander convenes a post-incident review. Attendees include IT operations, the SOC, the help desk, and a business unit lead. The draft timeline shows detection took 6 hours, containment 9 hours, and recovery 3 days against a 24-hour RTO. The help desk lead says the initial ticket was misrouted and sat for 90 minutes. The SOC says the EDR alert was suppressed by a tuning rule added three months ago. IT operations says the backup restore failed twice because the restore procedure was undocumented. The business unit lead wants to 'move on' and not 'assign blame.' The CISO wants three concrete corrective actions with owners and dates. The meeting is scheduled for 60 minutes.
1. How should the incident commander structure the 60-minute review to produce useful corrective actions without turning it into a blame session?
Read the worked answer
Structure around findings → root causes → corrective actions with owners and dates, and explicitly separate accountability for process from blame for people.
Suggested agenda (60 min):
- 5 min: Restate purpose - improve the process, not judge individuals. Establish that the goal is systemic fixes.
- 10 min: Walk the timeline factually (detection 6h, containment 9h, recovery 3d vs 24h RTO). Facts first, no commentary.
- 15 min: For each gap, ask 'what allowed this?' - misrouted ticket (routing rules/triage), suppressed EDR alert (tuning governance), failed restores (undocumented procedure). Focus on the condition, not the person.
- 20 min: Convert each root cause into a corrective action with a named owner and a date. Three actions minimum, as the CISO requested.
- 10 min: Confirm owners, dates, and how completion will be verified; set a follow-up review.
The commander should explicitly say that 'no blame' means no punishment for reporting, but it does not mean no accountability for fixing the conditions. That distinction keeps the business lead engaged and satisfies the CISO.
2. Draft the three corrective actions the CISO asked for, with owners and rationale tied to the timeline.
Read the worked answer
Each action should map to a measured failure and have an owner and date.
- Fix ticket routing and triage for security reports. Owner: help desk lead. Due: 14 days. Rationale: 90 minutes lost to misrouting. Action: add a security category with auto-route to the SOC and a triage SLA. Measure: time-to-route for security tickets.
- Institute change control for EDR tuning rules. Owner: SOC lead. Due: 21 days. Rationale: a tuning rule suppressed the alert and cost detection time. Action: require review/approval and a suppression-expiry date for any rule that disables or downgrades a detection; audit existing suppressions. Measure: number of unexpired suppressions without review.
- Document and test the backup restore procedure. Owner: IT operations lead. Due: 30 days. Rationale: two failed restores and 3-day recovery against a 24-hour RTO. Action: write the runbook, perform a timed restore test, and record actual restore time against RTO. Measure: tested restore time ≤ RTO.
Each action is specific, owned, dated, and tied to evidence from the timeline - which is what makes it credible rather than a generic 'improve processes' list.
3. The business unit lead argues the review should be closed with a general note to 'improve communication.' How should the commander respond?
Read the worked answer
The commander should respect the sentiment but reject the vague action, because 'improve communication' is unmeasurable and will not prevent recurrence.
Response:
- Acknowledge the goal: everyone wants to move on, and the review is not meant to prolong the incident.
- Explain why vague actions fail: without an owner, date, and measure, the action cannot be verified and the same gaps will recur. The 6-hour detection and 3-day recovery are concrete; the fixes must be too.
- Offer to fold communication into a specific action rather than drop it - e.g., a defined escalation path and status-update cadence with an owner and a test, so it is measurable.
- Anchor to the CISO's requirement for three concrete actions with owners and dates; the review's output is those actions, not a closing statement.
- Set a follow-up review to check completion, which gives the business lead a defined end point.
The judgement: 'no blame' and 'move on' are not the same as 'no accountability.' The commander converts the soft request into a hard, owned action.