3.6.1 Where appropriate, the relevant entities shall carry out post-incident reviews after recovery from …

Requirement

Where appropriate, the relevant entities shall carry out post-incident reviews after recovery from incidents. The post-incident reviews shall identify, where possible, the root cause of the incident and result in documented lessons learned to reduce the occurrence and consequences of future incidents.

Guidance

• Conduct root cause analysis (34) and identify the root cause of the incident, where possible.
• Identify contributing factors and areas for improvement in incident detection, response and recovery processes.
• Investigate significant incidents and write final incident reports, including actions taken and recommendations to mitigate future occurrence of this type of incident.
• Document lessons learnt, accompanied by recommendations and their owners, based on logs from incident response referred to in point 3.5.4 of the Annex to the regulation.
• Share any relevant findings in the post-incident review with affected stakeholders, for example suppliers, service providers, free and open source component maintainers.

Examples of evidence

• Results of root cause analysis.
• Individual reports of the handling of significant incidents.
• Documented lessons learnt from incidents.

1. Pārskats

1.1 Atsauces

1.2 Identificētās prasības

1.3 Saistītie tiesību akti

2. Identificētās prasības

3. Saistītie tiesību akti

Saistītie uzdevumi

• ENISA -