Insights · Field note · Security assurance and compliance
Post-incident control review: closing the loop
The incident is over when the controls that let it happen have changed and the change has been verified. Not before.
A post-incident control review asks which controls failed, were absent or were bypassed, why, and what changes would have prevented or shortened the incident; assigns those changes to owners with dates; verifies them when complete; and feeds the findings into the risk register, the response plan and the next exercise. It is distinct from the forensic investigation, which establishes what happened, and from the post-incident report to executives, which summarizes it. The review is where the organization becomes harder to breach the same way twice. NIST SP 800-61 includes lessons learned as part of the handling lifecycle; most organizations skip it because the incident feels finished.
In detail
What the evidence shows.
Questions the review asks
How did the attacker get in, and which control should have stopped that. How did they move, and which control should have contained it. How long until detection, and why. How long to contain, and what slowed it. What did recovery cost, and what would have made it faster. Which notification obligations were met late, and why.
From findings to changes
Each failure becomes a control change: a policy enforced, a gap closed, a detection added, a procedure rewritten, a vendor replaced. Each change has an owner, a date and a verification method. Changes are tracked to closure like any other finding, and acceptances are recorded where a change is declined.
Feeding the program
The risk register is updated with what the incident showed. The response plan and playbooks are revised. The next tabletop uses the real scenario. Monitoring rules are added for the precursors that were missed. Executive reporting shows the incident, the changes and their status until closed.
Verifying
A change that is planned and not verified is a finding waiting to recur. Validation tests that the new control works; the review is closed when the evidence shows it. See post-incident control review, control validation versus control existence and risk acceptance versus remediation.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days