3.6 Post-incident reviews

Requirement

Where appropriate, the relevant entities shall carry out post-incident reviews after recovery from incidents. The post-incident reviews shall identify, where possible, the root cause of the incident and result in documented lessons learned to reduce the occurrence and consequences of future incidents.

Guidance

• Conduct root cause analysis (34) and identify the root cause of the incident, where possible.
• Identify contributing factors and areas for improvement in incident detection, response and recovery processes.
• Investigate significant incidents and write final incident reports, including actions taken and recommendations to mitigate future occurrence of this type of incident.
• Document lessons learnt, accompanied by recommendations and their owners, based on logs from incident response referred to in point 3.5.4 of the Annex to the regulation.
• Share any relevant findings in the post-incident review with affected stakeholders, for example suppliers, service providers, free and open source component maintainers.

Examples of evidence

• Results of root cause analysis.
• Individual reports of the handling of significant incidents.
• Documented lessons learnt from incidents.

Requirement

The relevant entities shall ensure that post-incident reviews contribute to improving their approach to network and information security, to risk treatment measures and to incident handling, detection and response procedures.

Guidance

• Analyse the post-incident review findings to identify gaps and weaknesses in the entity’s network and information security status.
• Make sure that the identified gaps and weaknesses feed back to the risk assessment and risk treatment plan (Annex to the regulation, point 2.1).
• Assess whether existing risk treatment measures were effective in preventing or mitigating the incident.
• Document the findings and lessons learnt from each post-incident review comprehensively.
• Consider whether information security requirements have been met throughout the handling of a cybersecurity incident or whether measures may need to be taken to restore them (e.g. resetting passwords for emergency administrative access).

Examples of evidence

• Post-incident review reports that detail findings, lessons learnt and recommendations for improvement following security incidents.
• Analysis, resolution and mitigation measures taken, communicated to all relevant personnel.
• Updated risk assessment and risk treatment plan, which includes findings of the post-incident reviews.

Requirement

The relevant entities shall review at planned intervals if incidents led to post-incident reviews.

Guidance

• Conduct an annual review or a review after significant incidents, to determine if an incident has led to a post-incident review.

Examples of evidence

• Documented plans or schedules for future reviews.

Tips: guidance

• Determine the composition of the review team, including members from relevant departments such as IT, security, legal and management bodies.
• Review existing network and information security policies, topic-specific policies relevant to the incident, incident handling procedures and policy and incident response procedures in light of the lessons learnt from post-incident reviews.

Tips: examples of evidence

• Minutes of the post-incident review team.
• Evidence of updates to network and information security or topic-specific policies and procedures based on the lessons learnt from post-incident reviews.