5.2.5. Post-Incident Review Practices
💡 First Principle: Restoring service answers "is the system back," not "why did this happen and will it happen again" — closing that second question is what actually prevents recurrence, and skipping it on "minor" incidents forfeits the cheapest opportunities to learn.
A post-incident review conducts root cause analysis, documents lessons learned, and feeds specific control improvements back into Phase 4's control design and Phase 3's risk register — closing the loop the incident opened. Smaller incidents are often skipped for review because they feel low-stakes, but they frequently reveal the same systemic gaps a major incident would — at a fraction of the cost and disruption required to learn the lesson from a bigger event later.
⚠️ Exam Trap: Post-incident review is sometimes reserved only for major, high-severity incidents. The correct answer recognizes that smaller incidents often reveal the same systemic gaps as major ones, making review a valuable, low-cost opportunity regardless of severity.
Reflection Question: A minor, contained incident is resolved in under an hour with no data loss. Is a post-incident review still worth the time? What might it reveal that the quick, successful resolution obscured?
