Lessons learned and reporting

- [Voiceover] Once the incident response team…returns the organization to a normal operating state…all too often, the response effort ends…without completing an important final step:…conducting a Lessons Learned session…and writing up the results in an incident report.…The Lessons Learned process is designed to provide…everyone involved in the incident response effort…an opportunity to reflect on their individual role…in the incident and the team's response overall.…

It's an opportunity to improve…the processes and technologies used in incident response…to better respond to future security crises.…The most common way to conduct Lessons Learned…is to gather everyone in the same room…or connect them via teleconference or videoconference…and ask a trained facilitator…to lead a Lessons Learned session.…Ideally, this facilitator should have played…no role in the incident response,…leaving him or her with no preconceived notions…about the response.…

The facilitator should be a neutral party…who simply helps guide the conversation.…