Incident closure

Once the incident is mitigated and there are no intrusion signs remaining, the infrastructure is recovered and ready to return to normal operations.

Let’s have a look at our IR phases diagram in Figure 13.1. Post-incident steps are highlighted by a blue rectangle:

Figure 13.1 – Post-incident phase description

The process seems simple and straightforward; however, it still needs a detailed explanation. Table 13.1 uncovers the inputs, description, and outputs of each action item:

Action	Description of activity
12a. Provide Incident Report Input(s): Result of incident investigation, containment, recovery phases Output(s): Incident Report, Lessons Learned	Subject-matter experts (SMEs) or an external IRT (if engaged) prepare the incident report Prepare a lessons-learned meeting with...