A major incident has just been closed. The incident manager suggests holding the lessons-learned meeting at the next quarterly security review, in about three months, with only the security team present. What should the security manager recommend?
Select an answer to reveal the explanation.
Short Explanation
Memories fade fast, like footprints in sand. Get everyone in the room while the details are fresh, and that means everyone who touched the response, not just your own team. Waiting three months or narrowing the guest list loses half the lessons.
Full Explanation
Lessons-learned reviews are most valuable when held soon after the incident is closed, while participants still remember details, decisions and timings accurately and before records and context are lost. They should include representatives of all parties involved: responders, the affected business owners, IT operations, legal, communications, management and relevant third parties. Each group sees different parts of the response, and gaps often lie at the hand-offs between them. Waiting three months for a scheduled review allows recall to degrade and delays corrective actions, leaving known weaknesses in place for longer; objectivity comes from a structured, blameless format, not from delay. A written survey of the security team collects limited, one-sided input and loses the discussion through which participants reconcile different views of what happened. Holding the meeting immediately but restricting it to senior managers excludes the people who performed and observed the response, so the review would miss operational detail and may discourage candour. Exam caveat: complex incidents may need a short initial debrief followed by a fuller review once investigation findings are available. Operational check: confirm the review date, attendee list, facilitator and agenda are recorded, and that outputs feed the corrective action register.