Anthropic-Cybersecurity-Skills/skills/conducting-post-incident-lessons-learned/references/standards.md

Standards References - Post-Incident Lessons Learned

NIST SP 800-61 Rev. 2 - Section 3.4 Post-Incident Activity

• 3.4.1: Lessons Learned meetings after each significant incident
• 3.4.2: Using Collected Incident Data for trending and metrics
• Recommends formal review within days of resolution

NIST SP 800-61 Rev. 3 - Continuous Improvement

• Recover (RC) function: Learning from incidents
• RC.CO-03: Recovery activities and progress communicated
• Emphasis on continuous improvement of IR capabilities

SANS PICERL - Lessons Learned Phase

• Phase 6: Final phase of incident handling
• Formal review with all stakeholders
• Document improvements and update procedures

MITRE ATT&CK - Detection Gap Analysis

• Map incident techniques to ATT&CK framework
• Identify detection gaps in current monitoring
• Develop new detection rules based on observed TTPs

ISO 27001 - Clause 10: Improvement

• 10.1: Nonconformity and corrective action
• 10.2: Continual improvement
• Requires organizations to learn from security incidents

Google SRE Post-Mortem Culture

• Blameless approach to incident review
• Focus on systemic issues rather than human error
• Document and share learnings broadly