What Is a Post-Incident Review?

Definition

A post-incident review (also called a lessons-learned meeting, hotwash, or post-mortem) is the structured look back after a security incident: what happened, what worked, what failed, and what will change. It ends with a written report and assigned fixes. NIST calls it one of the most important parts of incident response, and also the most often skipped.

How It Works

NIST SP 800-61 Revision 2 recommends holding the meeting within several days of the incident ending, with everyone involved. Its core questions:

1. Exactly what happened, and at what times?
2. How well did staff and management perform? Were the documented procedures followed, and were they adequate?
3. What information was needed sooner?
4. Were any steps taken that might have slowed recovery?
5. What would we do differently next time?
6. How could information sharing with other organizations have improved?
7. What corrective actions would prevent a repeat?
8. Which indicators should we watch for in future?
9. What tools or resources do we need?

CISA's incident response playbook calls this step a "hotwash" and sets clear goals: confirm the root cause has been eliminated or mitigated, identify infrastructure and policy problems, clarify roles and authority, find training needs, and improve tools. NIST also recommends a follow-up report with a timestamped chronology of events and an estimate of the damage.

Revision 3 of SP 800-61 (April 2025) moves this into a continuous Improvement category: lessons should be shared as soon as they are identified, not only after recovery ends.

Real-World Example

In May and June 2023, a threat actor known as Storm-0558 compromised the Microsoft Exchange Online mailboxes of 22 organizations and more than 500 individuals, including senior U.S. government officials. The federal Cyber Safety Review Board published its review on March 20, 2024. It found the State Department detected the intrusion through a custom alert rule, nicknamed "Big Yellow Taxi," built on a mailbox access log called MailItemsAccessed, which State could use only because it had bought a premium license with enhanced logging. The Board concluded the intrusion "should never have happened" and resulted from "a cascade of security failures," then issued recommendations to Microsoft and to all cloud providers. It is a national-scale post-incident review, and its lesson scales down: if you are not paying for or keeping the right logs, you may never see the attack.

Why It Matters for a Small Business

Skipping the review is how the same incident happens twice. The review is where you find out the backup had not run in months, the former employee still had access, or nobody knew the insurer's hotline. It produces documents a small business can use: a timeline for your insurer, a list of fixes for your IT budget, and training material for staff. NIST notes that lessons-learned reports are good material for training new team members and for updating policies and procedures, and that small incidents need only limited review.

How to Spot It / How DTS Handles It

Signs you need one: an incident closed without a written summary, fixes that were "agreed" but never assigned, or a second incident that looks like the first.

After every DTS engagement we deliver a written report with the timeline, the root cause, what we changed, and a prioritized list of remaining fixes, and we can facilitate the review meeting with your team. See our incident response service.

Related Terms

• Incident response: the process the review improves.
• Root cause analysis: finding the real reason, not just the symptom.
• Recovery: the stage that ends just before the review.
• Tabletop exercise: practicing before the real incident, using past lessons.
• Security logging: the Storm-0558 lesson in one term.
• NIST SP 800-61: where the lessons-learned questions come from.

Sources

• NIST, SP 800-61 Rev. 2, Computer Security Incident Handling Guide (Section 3.4.1, Lessons Learned; withdrawn April 3, 2025 and superseded by Rev. 3): https://csrc.nist.gov/pubs/sp/800/61/r2/final
• NIST, SP 800-61 Rev. 3 (April 2025), Section 2.1 and the Improvement category (ID.IM): https://csrc.nist.gov/pubs/sp/800/61/r3/final
• CISA, Federal Government Cybersecurity Incident and Vulnerability Response Playbooks (Post-Incident Activities, p. 16): https://www.cisa.gov/resources-tools/resources/federal-government-cybersecurity-incident-and-vulnerability-response-playbooks
• Cyber Safety Review Board, Review of the Summer 2023 Microsoft Exchange Online Intrusion (March 20, 2024): https://www.cisa.gov/sites/default/files/2025-03/CSRBReviewOfTheSummer2023MEOIntrusion508.pdf

---

Last updated October 14, 2026.