ISO/IEC 27035 FAQ Post Incident Review

After recovery, create a timeline from event and incident records and compare actual detection, assessment, decisions, response, communications, recovery, and evidence handling with the plan. Include the incident coordinator, relevant responders, affected business or service owners, providers, control owners, and the incident management team members needed to route improvements.

The depth should match the incident's nature and severity. Separate urgent remediation from longer-term improvements, and record unresolved facts rather than forcing a final cause. Each action needs a risk-based priority, owner, due date, acceptance criteria, dependency, evidence, and closure authority.

Keep the reviewed timeline, participants, evidence consulted, scope and limitations, confirmed findings, unresolved questions, causes and contributing conditions where supported, what worked, failed controls or handoffs, and recommended actions. Link the review to the incident report without duplicating sensitive evidence unnecessarily.

Distinguish facts from hypotheses and recommendations. If legal privilege, personnel confidentiality, law-enforcement restrictions, or supplier terms limit circulation, retain a controlled full record and an appropriate operational version rather than omitting the limitation.

The incident coordinator should ensure the post-incident activity occurs and that the incident report is complete. A reviewer with enough independence to challenge the response should lead or validate significant reviews, while affected teams confirm factual accuracy.

The owner with authority over each affected control, service, supplier, policy, or budget should accept the related action. The appropriate risk or management authority should approve rejected, deferred, or residual-risk decisions.

Start after recovery when the incident's nature and severity justify a dedicated review and the essential records and participants are available. Immediate containment or safety actions should not wait for the review, and a complex investigation may require an interim review before all facts are final.

The meeting or report can close once its scope, evidence limits, findings, and actions are approved. Corrective actions remain open in their tracking system until implemented, evidenced, and checked against their acceptance criteria.

ISO/IEC 27035-1:2023 defines the generic process and its records, including the incident-management log and incident report. ISO/IEC 27035-2:2023 provides the detailed lessons-learned activities for the plan, teams, controls, risk assessment, management review, training, relationships, tools, and metrics. ISO/IEC 27035-3:2020 provides ICT operational evidence from notification, triage, analysis, containment, eradication, recovery, and reporting.

The standards apply globally to organizations of any type, size, or nature and can be adapted to risk and resources. They do not require the same meeting for every event, prescribe a fixed review deadline, or create legal privilege. The organization should define which incident types, severity levels, near misses, failed exercises, or recurring patterns trigger a dedicated review and should apply separate employment, privacy, litigation, regulatory, contractual, and evidence rules.