Improving the incident management processes and activities
Learning is a phase, not a courtesy
ISO/IEC 27035 places lessons learned inside the process. After containment and recovery, hold a post-incident review promptly, while memory is fresh, with responders, the affected business owner and, where relevant, legal and privacy. Reconstruct the timeline from records, identify what worked, what failed and what was luck, and separate root cause from contributing factors.
From findings to change
Use structured techniques such as the '5 whys' or cause-and-effect analysis, but stop at causes the organisation can act on. Convert each finding into a corrective action with an owner, due date and verification method; track actions in the same register as other risk treatments and escalate overdue ones. Update playbooks, detection rules, classification examples, training content and the risk register.
Measure improvement
Useful measures: time to detect, time to contain, percentage of incidents with a completed review, percentage of corrective actions closed on time, repeat incidents of the same type, exercise findings closed, and false-positive trends. Trends matter more than any single number; report them to management review.
Worked example
Three credential-phishing incidents in a quarter each end with a password reset. Reviews show the same missing control: no MFA on a legacy portal. The corrective action is MFA rollout with a deadline; the metric is repeat incidents, which falls to zero the next quarter.
Traps
A review that names a scapegoat and ends learning. Actions with no owner or date. Changing the playbook but not training anyone. Recording lessons in a document nobody reads instead of the risk and improvement registers.