Security · Incident Readiness · 09
Post-incident control review
A post-incident control review examines a security incident after it is contained to establish which controls failed, which were missing, which worked, and what must change so the same path cannot be used again. It is needed after any significant incident, when an insurer or regulator asks what the organization learned and changed, when the same type of event has recurred, or when the internal review stopped at the technical root cause without reaching the control that should have prevented it. The review produces a factual reconstruction of the event against the control environment, the control failures and gaps ranked by their role in the outcome, a remediation plan with owners and verification, and the report that demonstrates to insurers, regulators and customers that the organization responded with discipline.
Scope
What the review covers.
- Reconstruction of the event timeline from evidence
- Control analysis: what failed, what was absent, what worked
- Detection and response performance against the plan
- Root cause at the control level, not only the technical level
- Remediation plan with owners and verification
- Reporting for leadership, insurer, regulator and customers as required
Deliverables
What you receive.
| Deliverable | Form |
|---|---|
| Incident reconstruction | Timeline and evidence |
| Control analysis | Failures, gaps and effective controls, ranked |
| Remediation plan | Owned, dated, with verification criteria |
| Review report | For leadership and external parties |
Prerequisites
What we need from you.
- Access to the incident record, preserved evidence and the forensic report if one exists
- Participation of the people who responded
- Agreement on the audiences the report must serve
Related
Where this sits.
- Incident Readiness Service
- Security Hub
- Incident response planning Also
- Tabletop exercises Also
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days
Questions
Asked before engaging.
Is this a blame exercise?
No. It is a control exercise. The question is why the control environment allowed the outcome, and what changes it.
Can this be done for a near miss?
Yes, and it should be. Near misses are the cheapest incidents to learn from.
How does this relate to the forensic investigation?
Forensics establishes what happened technically. The control review establishes what the organization must change. They use the same evidence.